GitHub Advisoryadvisory · Maven

GHSA-g48f-ff5h-5f64 Exposure of Sensitive Information to an Unauthorized Actor in Apache Hadoop

MEDIUM Published 2022-05-17 Modified 2022-07-06 Official page ↗
Aliases
CVE-2015-1776
Ecosystem
Maven
Packages
org.apache.hadoop:hadoop-common
Severity
Moderate
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2022-07-06

Affected packages

• Maven org.apache.hadoop:hadoop-common: >= 2.6.0, < 2.6.5 → fixed in 2.6.5

Description

Apache Hadoop 2.6.x encrypts intermediate data generated by a MapReduce job and stores it along with the encryption key in a credentials file on disk when the Intermediate data encryption feature is enabled, which allows local users to obtain sensitive information by reading the file.

Related

Alias · CVE (1)

  • CVE-2015-1776 Apache Hadoop 2.6.x encrypts intermediate data generated by a MapReduce job and stores it along with the encryption key in a credentials… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References