GHSA-h24p-qwf4-84q8

Apache Hadoop's LinuxContainerExecutor runs docker commands as root with insufficient input validation

En bref

Publiée: 2022-05-17 02:41 UTC
Mise à jour: 2023-11-08 03:59 UTC
CVE: CVE-2017-7669
CVSS_V3: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root. This issue is fixed in versions 2.8.1 and 3.0.0-alpha3.

Paquets affectés

Paquet	Versions
Maven · org.apache.hadoop:hadoop-common	introduced 0, fixed 2.8.1
Maven · org.apache.hadoop:hadoop-common	introduced 3.0.0-alpha1, fixed 3.0.0-alpha3

Références

https://nvd.nist.gov/vuln/detail/CVE-2017-7669 ADVISORY
https://mail-archives.apache.org/mod_mbox/hadoop-user/201706.mbox/%3C4A2FDA56-491B-4C2A-915F-C9D4A4BDB92A%40apache.org%3E WEB
http://www.securityfocus.com/bid/98795 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database