Vulnerabilities > Apache > Hadoop > 3.0.0

DATE CVE VULNERABILITY TITLE RISK
2022-08-25 CVE-2021-25642 Deserialization of Untrusted Data vulnerability in Apache Hadoop
ZKConfigurationStore which is optionally used by CapacityScheduler of Apache Hadoop YARN deserializes data obtained from ZooKeeper without validation.
network
low complexity
apache CWE-502
8.8
2022-08-04 CVE-2022-25168 OS Command Injection vulnerability in Apache Hadoop
Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell.
network
low complexity
apache CWE-78
critical
9.8
2022-06-15 CVE-2021-33036 Path Traversal vulnerability in Apache Hadoop
In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user.
network
low complexity
apache CWE-22
8.8
2022-06-13 CVE-2021-37404 Out-of-bounds Write vulnerability in Apache Hadoop
There is a potential heap buffer overflow in Apache Hadoop libhdfs native code.
network
low complexity
apache CWE-787
critical
9.8
2022-04-07 CVE-2022-26612 Link Following vulnerability in Apache Hadoop
In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes.
network
low complexity
apache CWE-59
critical
9.8
2021-01-26 CVE-2020-9492 Incorrect Authorization vulnerability in multiple products
In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without proper verification.
network
low complexity
apache oracle CWE-863
8.8
2020-10-21 CVE-2018-11764 Missing Authentication for Critical Function vulnerability in Apache Hadoop 3.0.0
Web endpoint authentication check is broken in Apache Hadoop 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0.
network
low complexity
apache CWE-306
critical
9.0
2020-09-30 CVE-2018-11765 Improper Authentication vulnerability in Apache Hadoop
In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication when Kerberos authentication is enabled and SPNEGO through HTTP is not enabled.
network
low complexity
apache CWE-287
7.5
2019-10-04 CVE-2018-11768 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Apache Hadoop
In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be corrupted across storing in fsimage and reading back from fsimage.
network
low complexity
apache CWE-119
7.5
2019-05-30 CVE-2018-8029 Unspecified vulnerability in Apache Hadoop
In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.
network
low complexity
apache
8.8