Login Request a demo
Unscored severity · published Jan 24, 2014
CVE-2013-2192
The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos security features are enabled, allows…
–
CVSS
1.1%
EPSS
No
On KEV
Description
The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos security features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information by forcing a downgrade to simple authentication.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HA
Hadoop · Apache
0.23.0; 0.23.1; 0.23.3; 0.23.4; 0.23.5; 0.23.6; +17 more · source: NVD
Affected product
HA
Hadoop
Apache
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-2192
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-2192
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2014-0037.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2014-0400.html
seclists.org
http://seclists.org/fulldisclosure/2013/Aug/251
secunia.com
http://secunia.com/advisories/57915
www.cloudera.com
https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html
More from Hadoop
9.8
CVE-2022-25168
Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTar
9.8
CVE-2021-37404
There is a potential heap buffer overflow in Apache Hadoop libhdfs native code
9.8
CVE-2022-26612
In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes
9.8
CVE-2019-17195
Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or…
9.8
CVE-2017-15718
The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications