Advisoriesby IbisApache HadoopGHSA-h24p-qwf4-84q8
Apache Hadoop's LinuxContainerExecutor runs docker commands as root with insufficient input validation
Fix: upgrade to 2.8.1 or later (2 fixed versions below)
In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root. This issue is fixed in versions 2.8.1 and 3.0.0-alpha3.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.hadoop:hadoop-common Maven | < 2.8.1 | 2.8.1 |
| >= 3.0.0-alpha1, < 3.0.0-alpha3 | 3.0.0-alpha3 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-20
- Also known as
- CVE-2017-7669
More Apache Hadoop advisories
All Apache Hadoop
Exposure of Sensitive Information to an Unauthorized Actor in Apache HadoopCVE-2015-1776fixed in 2.6.5Improper Access Control in Apache HadoopCVE-2016-5393fixed in 2.6.5 +1Improper Authentication in Apache HadoopCVE-2013-2192fixed in 0.23.9 +1Improper Authentication in Apache HadoopCVE-2014-0229fixed in 0.23.11 +1Insecure Inherited Permissions in Apache HadoopCVE-2016-6811fixed in 2.7.4Exposure of Sensitive Information to an Unauthorized Actor in Apache HadoopCVE-2016-5001fixed in 2.6.4 +1