GitHub Advisoryadvisory · Maven

GHSA-c6f9-4pmv-m7m6 Apache Hadoop allows impersonation of arbitrary cluster user accounts

MEDIUM Published 2022-05-17 Modified 2023-08-29 Official page ↗
Aliases
CVE-2012-1574
Ecosystem
Maven
Packages
org.apache.hadoop:hadoop-main
Severity
Moderate
Weaknesses
CWE-287
Reviewed
2023-08-29

Affected packages

• Maven org.apache.hadoop:hadoop-main: >= 0.23, < 0.23.2 → fixed in 0.23.2 • Maven org.apache.hadoop:hadoop-main: >= 1.0, < 1.0.2 → fixed in 1.0.2

Description

The Kerberos/MapReduce security functionality in Apache Hadoop 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before 1.0.2, as used in Cloudera CDH CDH3u0 through CDH3u2, Cloudera hadoop-0.20-sbin before 0.20.2+923.197, and other products, allows remote authenticated users to impersonate arbitrary cluster user accounts via unspecified vectors.

Related

Alias · CVE (1)

  • CVE-2012-1574 The Kerberos/MapReduce security functionality in Apache Hadoop 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before 1.0.2,… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References