HA
Product
Hadoop
37
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 20Medium 6Low 0
Watch
Add Hadoop to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-25168 | 9.8 | Aug 4 | Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTar Affected: 2.0.0 through 2.10.1; 3.0.0 through 3.2.3; 3.3.0 through 3.3.2 |
| CVE-2021-37404 | 9.8 | Jun 13 | There is a potential heap buffer overflow in Apache Hadoop libhdfs native code Affected: 2.9.0 before 2.10.2; 3.0.0 through 3.1.4; 3.2.0 before 3.2.3; 3.3.0 before 3.3.2 |
| CVE-2022-26612 | 9.8 | Apr 7 | In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes Affected: before 3.2.3; 3.3.1; 3.3.2 |
| CVE-2019-17195 | 9.8 | Oct 15 | Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or… Affected: 3.2.1 |
| CVE-2017-15718 | 9.8 | Jan 24 | The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications Affected: 2.7.3; 2.7.4 |
| CVE-2012-4449 | 9.8 | Oct 30 | Apache Hadoop before 0.23.4, 1.x before 1.0.4, and 2.x before 2.0.2 generate token passwords using a 20-bit secret when Kerberos security features are enabled, which makes it… Affected: through 0.23.3; 1.0.0; 1.0.1; 1.0.2; 1.0.3; 2.0.0; +2 more |
| CVE-2016-3086 | 9.8 | Sep 5 | The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for credential store provider used by the NodeManager to YARN Applications Affected: 2.6.0; 2.6.1; 2.6.2; 2.6.3; 2.6.4; 2.7.0; +2 more |
| CVE-2021-25642 | 8.8 | Aug 25 | ZKConfigurationStore which is optionally used by CapacityScheduler of Apache Hadoop YARN deserializes data obtained from ZooKeeper without validation Affected: 2.9.0 before 2.10.2; 3.0.0 before 3.2.4; 3.3.0 before 3.3.4 |
| CVE-2021-33036 | 8.8 | Jun 15 | In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user Affected: 2.2.0 before 2.10.2; 3.0.1 before 3.2.3; 3.3.0 before 3.3.2; 3.0.0; 3.0.0; 3.0.0; +1 more |
| CVE-2020-9492 | 8.8 | Jan 26 | In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without proper verification Affected: 2.0.0 through 2.10.0; 3.0.0 through 3.1.3; 3.2.0 through 3.2.1 |
| CVE-2018-11764 | 8.8 | Oct 21 | Web endpoint authentication check is broken in Apache Hadoop 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0 Affected: 3.0.0; 3.0.0; 3.0.0 |
| CVE-2018-8029 | 8.8 | May 30 | In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user Affected: 2.2.0 through 2.8.4; 3.0.1 through 3.1.0; 2.9.0; 2.9.1; 3.0.0; 3.0.0; +4 more |
| CVE-2018-11766 | 8.8 | Nov 27 | In Apache Hadoop 2.7.4 to 2.7.6, the security fix for CVE-2016-6811 is incomplete Affected: 2.7.4 through 2.7.6 |
| CVE-2018-8009 | 8.8 | Nov 13 | Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the zip slip vulnerability in places that… Affected: 0.23.0 through 0.23.11; 2.0.0 through 2.7.6; 2.8.0 through 2.8.4; 2.9.0 through 2.9.1; 3.0.0 through 3.0.2; 2.0.0; +6 more |
| CVE-2016-6811 | 8.8 | Apr 11 | In Apache Hadoop 2.x before 2.7.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user Affected: 2.2.0 through 2.7.3 |
| CVE-2016-5393 | 8.8 | Nov 29 | In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with the HDFS NameNode can possibly run arbitrary commands with the same privileges… Affected: 2.7.0; 2.7.1; 2.7.2; 2.6.0; 2.6.1; 2.6.2; +2 more |
| CVE-2015-7430 | 8.4 | Jan 2 | The Hadoop connector 1.1.1, 2.4, 2.5, and 2.7.0-0 before 2.7.0-3 for IBM Spectrum Scale and General Parallel File System (GPFS) allows local users to read or write to arbitrary… Affected: 1.1.1; 2.4.0; 2.5.0; 2.7.0 |
| CVE-2017-3166 | 7.8 | Nov 13 | In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, if a file in an encryption zone with access permissions that make it world readable is localized via… Affected: 2.6.1; 2.6.2; 2.6.3; 2.6.4; 2.6.5; 2.7.0; +4 more |
| CVE-2023-26031 | 7.5 | Nov 16 | Relative library resolution in linux container-executor binary in Apache Hadoop 3.3.1-3.3.4 on Linux allows local user to gain root privileges Affected: 3.3.1 through 3.3.4 |
| CVE-2018-11765 | 7.5 | Sep 30 | In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication when Kerberos authentication is enabled… Affected: 2.8.0 through 2.8.5; 2.9.0 through 2.9.2; 3.0.0; 3.0.0 |
| CVE-2012-2945 | 7.5 | Oct 29 | Hadoop 1.0.3 contains a symlink vulnerability Affected: 1.0.3 |
| CVE-2018-11768 | 7.5 | Oct 4 | In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be corrupted across storing in fsimage and reading… Affected: 2.2.0 through 2.8.4; 2.9.0 through 2.9.1; 3.0.1 through 3.0.3; 3.1.0 through 3.1.1; 2.0.0; 2.0.0; +21 more |
| CVE-2018-1296 | 7.5 | Feb 7 | In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, HDFS exposes extended attribute key/value pairs during listXAttrs, verifying only path-level… Affected: 2.5.0 through 2.7.5; 2.8.0; 2.8.1; 2.8.2; 2.8.3; 2.9.0; +6 more |
| CVE-2017-7669 | 7.5 | Jun 5 | In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation Affected: 2.8.0; 3.0.0; 3.0.0 |
| CVE-2018-11767 | 7.4 | Mar 18 | In Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6, KMS blocking users or granting access to users incorrectly, if the system uses non-default groups mapping… Affected: 2.7.5 through 2.7.6; 2.8.3 through 2.8.4; 2.9.0 through 2.9.1 |
| CVE-2025-27821 | 7.3 | Jan 26 | Out-of-bounds Write vulnerability in Apache Hadoop HDFS native client Affected: 3.2.0 before 3.4.2 |
| CVE-2017-3162 | 7.3 | Apr 26 | HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace Affected: through 2.6.5 |
| CVE-2017-15713 | 6.5 | Jan 19 | Vulnerability in Apache Hadoop 0.23.x, 2.x before 2.7.5, 2.8.x before 2.8.3, and 3.0.0-alpha through 3.0.0-beta1 allows a cluster user to expose private files owned by the user… Affected: 0.23.0 through 0.23.11; 2.2.0 through 2.8.2; 2.0.0; 2.0.1; 2.0.2; 2.0.3; +10 more |
| CVE-2014-0229 | 6.5 | Mar 23 | Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1, as used in Cloudera CDH 5.0.x before 5.0.2, do not check authorization for the (1) refreshNamenodes, (2) deleteBlockPool,… Affected: 0.23.0; 0.23.1; 0.23.3; 0.23.4; 0.23.5; 0.23.6; +16 more |
| CVE-2024-23454 | 6.2 | Sep 25 | Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default Affected: before 3.4.0 |
| CVE-2015-1776 | 6.2 | Apr 19 | Apache Hadoop 2.6.x encrypts intermediate data generated by a MapReduce job and stores it along with the encryption key in a credentials file on disk when the Intermediate data… Affected: 2.6.0; 2.6.1; 2.6.2; 2.6.3; 2.6.4 |
| CVE-2017-3161 | 6.1 | Apr 26 | The HDFS web UI in Apache Hadoop before 2.7.0 is vulnerable to a cross-site scripting (XSS) attack through an unescaped query parameter Affected: through 2.6.5 |
| CVE-2016-5001 | 5.5 | Aug 30 | This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of HDFS Affected: through 2.6.3; 2.7.0; 2.7.1 |
| CVE-2014-3627 | – | Dec 5 | The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote cluster users to change the permissions… Affected: 0.23.0; 0.23.1; 0.23.3; 0.23.4; 0.23.5; 0.23.6; +20 more |
| CVE-2013-2192 | – | Jan 24 | The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos security features are enabled, allows… Affected: 0.23.0; 0.23.1; 0.23.3; 0.23.4; 0.23.5; 0.23.6; +17 more |
| CVE-2012-3376 | – | Jul 12 | DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a… Affected: 2.0.0 |
| CVE-2012-1574 | – | Apr 12 | The Kerberos/MapReduce security functionality in Apache Hadoop 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before 1.0.2, as used in Cloudera CDH CDH3u0 through… Affected: 0.20.203.0; 0.20.204.0; 0.20.205.0; 0.23.0; 0.23.1; 1.0.0; +1 more |
Showing 37