Unscored severity · published Apr 12, 2012
CVE-2012-1574
The Kerberos/MapReduce security functionality in Apache Hadoop 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before 1.0.2, as used in Cloudera CDH CDH3u0 through…
–
CVSS
4.8%
EPSS
No
On KEV
Description
The Kerberos/MapReduce security functionality in Apache Hadoop 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before 1.0.2, as used in Cloudera CDH CDH3u0 through CDH3u2, Cloudera hadoop-0.20-sbin before 0.20.2+923.197, and other products, allows remote authenticated users to impersonate arbitrary cluster user accounts via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.8% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Cloudera Cdh · Cloudera
cdh3; cdh3; cdh3 · source: NVD
HA
Hadoop · Apache
0.20.203.0; 0.20.204.0; 0.20.205.0; 0.23.0; 0.23.1; 1.0.0; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-1574
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-1574
archives.neohapsis.com
http://archives.neohapsis.com/archives/bugtraq/2012-04/0051.html
seclists.org
http://seclists.org/fulldisclosure/2012/Apr/70
secunia.com
http://secunia.com/advisories/48775
secunia.com
http://secunia.com/advisories/48776
www.securityfocus.com
http://www.securityfocus.com/bid/52939
Vendor Advisory
https://ccp.cloudera.com/display/DOC/Cloudera+Security+Bulletin
More from Hadoop
9.8
CVE-2022-25168
Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTar
9.8
CVE-2021-37404
There is a potential heap buffer overflow in Apache Hadoop libhdfs native code
9.8
CVE-2022-26612
In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes
9.8
CVE-2019-17195
Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or…
9.8
CVE-2017-15718
The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications