Improper Authentication in Apache Hadoop

CVE-2014-0229 · Published May 17, 2022 · updated Nov 8, 2023

Medium6.5

Fix: upgrade to 0.23.11 or later (2 fixed versions below)

Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1, as used in Cloudera CDH 5.0.x before 5.0.2, do not check authorization for the (1) refreshNamenodes, (2) deleteBlockPool, and (3) shutdownDatanode HDFS admin commands, which allows remote authenticated users to cause a denial of service (DataNodes shutdown) or perform unnecessary operations by issuing a command.

Affected versions

Package	Affected	Fixed in
org.apache.hadoop:hadoop-common Maven	>= 0.23.0, < 0.23.11	0.23.11
	>= 2.0.0, < 2.4.1	2.4.1

Details and references

CVSS 3.0: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Severity from: GitHub (reviewed advisory)
Weakness: CWE-287
Also known as: CVE-2014-0229

More Apache Hadoop advisories

All Apache Hadoop

Medium 6.2May 17, 2022

Exposure of Sensitive Information to an Unauthorized Actor in Apache HadoopCVE-2015-1776fixed in 2.6.5 High 8.8May 17, 2022

Improper Access Control in Apache HadoopCVE-2016-5393fixed in 2.6.5 +1 LowMay 17, 2022

Improper Authentication in Apache HadoopCVE-2013-2192fixed in 0.23.9 +1 High 7.5May 17, 2022

Apache Hadoop's LinuxContainerExecutor runs docker commands as root with insufficient input validationCVE-2017-7669fixed in 2.8.1 +1 High 8.8May 14, 2022

Insecure Inherited Permissions in Apache HadoopCVE-2016-6811fixed in 2.7.4 Medium 5.5May 13, 2022

Exposure of Sensitive Information to an Unauthorized Actor in Apache HadoopCVE-2016-5001fixed in 2.6.4 +1