Exposure of Sensitive Information to an Unauthorized Actor in Apache Hadoop

CVE-2015-1776 · Published May 17, 2022 · updated Nov 8, 2023

Medium6.2

Fix: upgrade to 2.6.5 or later

Apache Hadoop 2.6.x encrypts intermediate data generated by a MapReduce job and stores it along with the encryption key in a credentials file on disk when the Intermediate data encryption feature is enabled, which allows local users to obtain sensitive information by reading the file.

Affected versions

Package	Affected	Fixed in
org.apache.hadoop:hadoop-common Maven	>= 2.6.0, < 2.6.5	2.6.5

Details and references

CVSS 3.0: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity from: GitHub (reviewed advisory)
Weakness: CWE-200
Also known as: CVE-2015-1776

More Apache Hadoop advisories

All Apache Hadoop

High 8.8May 17, 2022

Improper Access Control in Apache HadoopCVE-2016-5393fixed in 2.6.5 +1 LowMay 17, 2022

Improper Authentication in Apache HadoopCVE-2013-2192fixed in 0.23.9 +1 Medium 6.5May 17, 2022

Improper Authentication in Apache HadoopCVE-2014-0229fixed in 0.23.11 +1 High 7.5May 17, 2022

Apache Hadoop's LinuxContainerExecutor runs docker commands as root with insufficient input validationCVE-2017-7669fixed in 2.8.1 +1 High 8.8May 14, 2022

Insecure Inherited Permissions in Apache HadoopCVE-2016-6811fixed in 2.7.4 Medium 5.5May 13, 2022

Exposure of Sensitive Information to an Unauthorized Actor in Apache HadoopCVE-2016-5001fixed in 2.6.4 +1