GitHub Advisoryadvisory · Maven

GHSA-h24p-qwf4-84q8 Apache Hadoop's LinuxContainerExecutor runs docker commands as root with insufficient input validation

HIGH Published 2022-05-17 Modified 2022-11-22 Official page ↗
Aliases
CVE-2017-7669
Ecosystem
Maven
Packages
org.apache.hadoop:hadoop-common
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20
Reviewed
2022-11-22

Affected packages

• Maven org.apache.hadoop:hadoop-common: < 2.8.1 → fixed in 2.8.1 • Maven org.apache.hadoop:hadoop-common: >= 3.0.0-alpha1, < 3.0.0-alpha3 → fixed in 3.0.0-alpha3

Description

In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root. This issue is fixed in versions 2.8.1 and 3.0.0-alpha3.

Related

Alias · CVE (1)

  • CVE-2017-7669 In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References