Apache Software Foundation Apache Hadoop
18 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2024-23454 | < 3.4.0 | Apache Hadoop: Temporary File Local Information Disclosure | MEDIUM 6.2 | 0.4 % | ||
| CVE-2023-26031 | 3.3.1 – < 3.3.5 | Privilege escalation in Apache Hadoop Yarn container-executor binary on Linux systems | HIGH 7.5 | 2.1 % | ||
| CVE-2021-25642 | 2.9.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.3, and 3.3.0 to 3.3.3 | Apache Hadoop YARN remote code execution in ZKConfigurationStore of capacity scheduler | HIGH 8.8 | 2.3 % | ||
| CVE-2022-25168 | 2.0.0 to 2.10.1 ; 3.0.0-alpha to 3.2.3 ; 3.3.0 to 3.3.2 | Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTar | CRITICAL 9.8 | 4.6 % | ||
| CVE-2021-33036 | 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1 | Apache Hadoop Privilege escalation vulnerability | HIGH 8.8 | 4.0 % | ||
| CVE-2021-37404 | 2.9.0 to 2.10.1 ; 3.0.0 to 3.1.4 ; 3.2.0 to 3.2.2 ; … | Heap buffer overflow in libhdfs native library | CRITICAL 9.8 | 3.0 % | ||
| CVE-2022-26612 | unspecified – < 3.2.3 ; 3.3.1 ; 3.3.2 | Arbitrary file write in FileUtil#unpackEntries on Windows | CRITICAL 9.8 | 4.2 % | ||
| CVE-2018-1296 | Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, 2.5.0 to 2.7.5 | In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, HDFS exposes extended attribute key/value pairs during li | HIGH 7.5 | 3.3 % | ||
| CVE-2018-11766 | Apache Hadoop 2.7.4 to 2.7.6 | In Apache Hadoop 2.7.4 to 2.7.6, the security fix for CVE-2016-6811 is incomplete. A user who can escalate to yarn user can possibly run arb | HIGH 8.8 | 3.2 % | ||
| CVE-2018-8009 | Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 | Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the zi | HIGH 8.8 | 6.7 % | ||
| CVE-2017-15718 | 2.7.3 to 2.7.4 | The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Ap | CRITICAL 9.8 | 3.6 % | ||
| CVE-2017-15713 | 0.23.0 to 0.23.11 ; 2.0.0-alpha to 2.8.2 ; 3.0.0-alpha to 3.0.0-beta1 | Vulnerability in Apache Hadoop 0.23.x, 2.x before 2.7.5, 2.8.x before 2.8.3, and 3.0.0-alpha through 3.0.0-beta1 allows a cluster user to ex | MEDIUM 6.5 | 2.2 % | ||
| CVE-2017-3166 | 2.6.1 to 2.6.5 ; 2.7.0 to 2.7.3 ; 3.0.0-alpha1 to 3.0.0-alpha3 | In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, if a file in an encryption zone with access permissions that mak | HIGH 7.8 | 0.3 % | ||
| CVE-2016-3086 | 2.6.0 to 2.6.4 ; 2.7.0 to 2.7.2 | The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for credential store provider used by | CRITICAL 9.8 | 3.6 % | ||
| CVE-2016-5001 | 2.1.0 to 2.6.3 ; 2.7.0 to 2.7.1 | This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of H | MEDIUM 5.5 | 0.7 % | ||
| CVE-2017-7669 | 2.8.0 ; 3.0.0-alpha1 and 3.0.0-alpha2 | In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input vali | HIGH 7.5 | 1.8 % | ||
| CVE-2017-3162 | 2.6.x and earlier | HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace. The NameNode is provided as a query parameter that is not | HIGH 7.3 | 6.4 % | ||
| CVE-2017-3161 | 2.6.x and earlier | The HDFS web UI in Apache Hadoop before 2.7.0 is vulnerable to a cross-site scripting (XSS) attack through an unescaped query parameter. | MEDIUM 6.1 | 3.9 % |