GitHub Advisoryadvisory · Maven

GHSA-pr9x-qmp5-j3rr Improper Input Validation in Apache Hadoop

HIGH Published 2022-05-13 Modified 2022-07-01 Official page ↗
Aliases
CVE-2017-3162
Ecosystem
Maven
Packages
org.apache.hadoop:hadoop-client
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-20
Reviewed
2022-07-01

Affected packages

• Maven org.apache.hadoop:hadoop-client: < 2.7.0 → fixed in 2.7.0

Description

HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace. The NameNode is provided as a query parameter that is not validated in Apache Hadoop before 2.7.0.

Related

Alias · CVE (1)

  • CVE-2017-3162 HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References