GitHub Advisoryadvisory · Maven

GHSA-rmpj-7c96-mrg8 Apache Hadoop heap overflow before v2.10.2, v3.2.3, v3.3.2

CRITICAL Published 2022-06-14 Modified 2023-06-27 Official page ↗
Aliases
CVE-2021-37404
Ecosystem
Maven
Packages
org.apache.hadoop:hadoop-common
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-120, CWE-131, CWE-787
Reviewed
2022-06-17

Affected packages

• Maven org.apache.hadoop:hadoop-common: >= 3.3.0, < 3.3.2 → fixed in 3.3.2 • Maven org.apache.hadoop:hadoop-common: >= 3.0.0, < 3.2.3 → fixed in 3.2.3 • Maven org.apache.hadoop:hadoop-common: < 2.10.2 → fixed in 2.10.2

Description

There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may result in a denial of service or arbitrary code execution. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.

Related

Alias · CVE (1)

  • CVE-2021-37404 There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. vulnerability

Weakness · CWE (3)

  • CWE-120 Buffer Copy without Checking Size of Input weakness
  • CWE-131 Incorrect Calculation of Buffer Size weakness
  • CWE-787 Out-of-bounds Write weakness

References