GitHub Advisoryadvisory · Maven

GHSA-9r7g-325h-mxrm Improper Authentication in Apache Hadoop

MEDIUM Published 2022-05-17 Modified 2022-07-07 Official page ↗
Aliases
CVE-2014-0229
Ecosystem
Maven
Packages
org.apache.hadoop:hadoop-common
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-287
Reviewed
2022-07-07

Affected packages

• Maven org.apache.hadoop:hadoop-common: >= 0.23.0, < 0.23.11 → fixed in 0.23.11 • Maven org.apache.hadoop:hadoop-common: >= 2.0.0, < 2.4.1 → fixed in 2.4.1

Description

Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1, as used in Cloudera CDH 5.0.x before 5.0.2, do not check authorization for the (1) refreshNamenodes, (2) deleteBlockPool, and (3) shutdownDatanode HDFS admin commands, which allows remote authenticated users to cause a denial of service (DataNodes shutdown) or perform unnecessary operations by issuing a command.

Related

Alias · CVE (1)

  • CVE-2014-0229 Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1, as used in Cloudera CDH 5.0.x before 5.0.2, do not check authorization for the… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References