GitHub Advisoryadvisory · Maven

GHSA-q46v-cj5v-hvg6 Use of a Broken or Risky Cryptographic Algorithm in Apache Hadoop

CRITICAL Published 2022-05-17 Modified 2022-07-13 Official page ↗
Aliases
CVE-2012-4449
Ecosystem
Maven
Packages
org.apache.hadoop:hadoop-client
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-327
Reviewed
2022-07-13

Affected packages

• Maven org.apache.hadoop:hadoop-client: < 0.23.4 → fixed in 0.23.4 • Maven org.apache.hadoop:hadoop-client: >= 1.0.0, < 1.0.4 → fixed in 1.0.4 • Maven org.apache.hadoop:hadoop-client: >= 2.0.0, < 2.0.2 → fixed in 2.0.2

Description

Apache Hadoop before 0.23.4, 1.x before 1.0.4, and 2.x before 2.0.2 generate token passwords using a 20-bit secret when Kerberos security features are enabled, which makes it easier for context-dependent attackers to crack secret keys via a brute-force attack.

Related

Alias · CVE (1)

  • CVE-2012-4449 Apache Hadoop before 0.23.4, 1.x before 1.0.4, and 2.x before 2.0.2 generate token passwords using a 20-bit secret when Kerberos security… vulnerability

Weakness · CWE (1)

  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm weakness

References