GitHub Advisoryadvisory · Maven

GHSA-jpmf-8cj2-595g Improper Link Resolution Before File Access in Apache Hadoop

MEDIUM Published 2022-05-17 Modified 2022-07-07 Official page ↗
Aliases
CVE-2014-3627
Ecosystem
Maven
Packages
org.apache.hadoop:hadoop-client
Severity
Moderate
Weaknesses
CWE-59
Reviewed
2022-07-07

Affected packages

• Maven org.apache.hadoop:hadoop-client: >= 0.23.0, < 1.0.1 → fixed in 1.0.1 • Maven org.apache.hadoop:hadoop-client: >= 2.0.0, < 2.5.2 → fixed in 2.5.2

Description

The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote cluster users to change the permissions of certain files to world-readable via a symlink attack in a public tar archive, which is not properly handled during localization, related to distributed cache.

Related

Alias · CVE (1)

  • CVE-2014-3627 The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote… vulnerability

Weakness · CWE (1)

  • CWE-59 Improper Link Resolution Before File Access weakness

References