GitHub Advisoryadvisory · Maven

GHSA-895m-ww55-59vw Exposure of Sensitive Information to an Unauthorized Actor in Apache Hadoop

CRITICAL Published 2022-05-17 Modified 2022-07-06 Official page ↗
Aliases
CVE-2016-3086
Ecosystem
Maven
Packages
org.apache.hadoop:hadoop-yarn-server-nodemanager
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-200
Reviewed
2022-07-06

Affected packages

• Maven org.apache.hadoop:hadoop-yarn-server-nodemanager: >= 2.6.0, < 2.6.5 → fixed in 2.6.5 • Maven org.apache.hadoop:hadoop-yarn-server-nodemanager: >= 2.7.0, < 2.7.3 → fixed in 2.7.3

Description

The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for credential store provider used by the NodeManager to YARN Applications.

Related

Alias · CVE (1)

  • CVE-2016-3086 The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for credential store provider used by… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References