CVEvulnerability
CVE-2016-3086
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2017-09-05
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for credential store provider used by the NodeManager to YARN Applications.
Affected configurations
• apache hadoop 2.6.0
• apache hadoop 2.6.1
• apache hadoop 2.6.2
• apache hadoop 2.6.3
• apache hadoop 2.6.4
• apache hadoop 2.7.0
• apache hadoop 2.7.1
• apache hadoop 2.7.2
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://mail-archives.apache.org/mod_mbox/hadoop-general/201701.mbox/%3C0ed32746-5a53-9051-5877-2b1abd88beb6%40apache.org%3E Mailing List, Mitigation, Vendor Advisory
- http://www.securityfocus.com/bid/95335 Third Party Advisory, VDB Entry
- http://mail-archives.apache.org/mod_mbox/hadoop-general/201701.mbox/%3C0ed32746-5a53-9051-5877-2b1abd88beb6%40apache.org%3E Mailing List, Mitigation, Vendor Advisory
- http://www.securityfocus.com/bid/95335 Third Party Advisory, VDB Entry