GitHub Advisoryadvisory · Maven

GHSA-4fh8-pm7g-pmxq Authentication bypass in Apache Hadoop

HIGH Published 2022-02-10 Modified 2021-04-22 Official page ↗
Aliases
CVE-2018-11764
Ecosystem
Maven
Packages
org.apache.hadoop:hadoop-main
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-306
Reviewed
2021-04-22

Affected packages

• Maven org.apache.hadoop:hadoop-main: >= 3.0.0-alpha4, < 3.0.1 → fixed in 3.0.1 • Maven org.apache.hadoop:hadoop-main: >= 3.0.0-beta1, < 3.0.1 → fixed in 3.0.1 • Maven org.apache.hadoop:hadoop-main: >= 3.0.0, < 3.0.1 → fixed in 3.0.1

Description

Web endpoint authentication check is broken in Apache Hadoop 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0. Authenticated users may impersonate any user even if no proxy user is configured.

Related

Alias · CVE (1)

  • CVE-2018-11764 Web endpoint authentication check is broken in Apache Hadoop 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0. vulnerability

Weakness · CWE (1)

  • CWE-306 Missing Authentication for Critical Functionality weakness

References