GitHub Advisoryadvisory · Maven

GHSA-pxv5-5vmp-3jj4 Improper Authentication in Apache Hadoop

LOW Published 2022-05-17 Modified 2022-07-08 Official page ↗
Aliases
CVE-2013-2192
Ecosystem
Maven
Packages
org.apache.hadoop:hadoop-common
Severity
Low
Weaknesses
CWE-287
Reviewed
2022-07-08

Affected packages

• Maven org.apache.hadoop:hadoop-common: >= 2.0.0, < 2.0.6-alpha → fixed in 2.0.6-alpha • Maven org.apache.hadoop:hadoop-common: >= 0.23.0, < 0.23.9 → fixed in 0.23.9

Description

The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos security features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information by forcing a downgrade to simple authentication.

Related

Alias · CVE (1)

  • CVE-2013-2192 The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References