Advisoriesby IbisApache HadoopGHSA-8r28-r8cp-g6cp
Exposure of Sensitive Information to an Unauthorized Actor in Apache Hadoop
Fix: upgrade to 2.6.4 or later (2 fixed versions below)
This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of HDFS. A local user on an HDFS DataNode may be able to craft a block token that grants unauthorized read access to random files by guessing certain fields in the token.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.hadoop:hadoop-common Maven | < 2.6.4 | 2.6.4 |
| >= 2.7.0, < 2.7.2 | 2.7.2 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-200
- Also known as
- CVE-2016-5001
More Apache Hadoop advisories
All Apache Hadoop
Exposure of Sensitive Information to an Unauthorized Actor in Apache HadoopCVE-2015-1776fixed in 2.6.5Improper Access Control in Apache HadoopCVE-2016-5393fixed in 2.6.5 +1Improper Authentication in Apache HadoopCVE-2013-2192fixed in 0.23.9 +1Improper Authentication in Apache HadoopCVE-2014-0229fixed in 0.23.11 +1Apache Hadoop's LinuxContainerExecutor runs docker commands as root with insufficient input validationCVE-2017-7669fixed in 2.8.1 +1Insecure Inherited Permissions in Apache HadoopCVE-2016-6811fixed in 2.7.4