GitHub Advisoryadvisory · Maven

GHSA-qmh2-h7r6-gm6q Client BlockTokens not checked in Apache Hadoop

HIGH Published 2022-05-17 Modified 2022-07-13 Official page ↗
Aliases
CVE-2012-3376
Ecosystem
Maven
Packages
org.apache.hadoop:hadoop-client
Severity
High
Reviewed
2022-07-13

Affected packages

• Maven org.apache.hadoop:hadoop-client: >= 2.0.0-alpha, < 2.0.1-alpha → fixed in 2.0.1-alpha

Description

DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have read access, and have other unspecified impacts.

Related

Alias · CVE (1)

  • CVE-2012-3376 DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out… vulnerability

References