Apache HadoopGHSA-f5fw-25gw-5m92
Apache Hadoop: Temporary File Local Information Disclosure
Low3.3CVE-2024-23454 · Published Sep 25, 2024 · updated Sep 10, 2026
Apache Hadoop’s `RunJar.run()` does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local users. As such, files written in this directory, without setting the correct posix permissions explicitly, may be viewable by all other local users.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.hadoop:hadoop-common Maven | < 3.4.0 | 3.4.0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-269, CWE-378
- Also known as
- CVE-2024-23454
- nvd.nist.gov/vuln/detail/CVE-2024-23454
- github.com/apache/hadoop/commit/8c2836402fbb2f619f1fef4ef625a8542e853a64
- github.com/apache/hadoop
- issues.apache.org/jira/browse/HADOOP-19031
- lists.apache.org/thread/xlo7q8kn4tsjvx059r789oz19hzgfkfs
- security.netapp.com/advisory/ntap-20241101-0002
- www.openwall.com/lists/oss-security/2024/09/25/1
More Apache Hadoop advisories
All Apache Hadoop| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 52022 | Apache Hadoop argument injection vulnerability Critical9.8Aug 5, 2022 | Critical9.8 | 2.10.2+2 more |
| Jun 142022 | Apache Hadoop heap overflow before v2.10.2, v3.2.3, v3.3.2Critical9.8Jun 14, 2022 | Critical9.8 | 2.10.2+2 more |
| May 172022 | Exposure of Sensitive Information to an Unauthorized Actor in Apache HadoopMedium6.2May 17, 2022 | Medium6.2 | 2.6.5 |
| May 172022 | Improper Access Control in Apache HadoopHigh8.8May 17, 2022 | High8.8 | 2.6.5+1 more |
| May 172022 | Improper Authentication in Apache HadoopLowMay 17, 2022 | Low | 0.23.9+1 more |
| May 172022 | Improper Authentication in Apache HadoopMedium6.5May 17, 2022 | Medium6.5 | 0.23.11+1 more |