HA
Product
Hadoop
37
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 20Medium 6Low 0
Watch
Add Hadoop to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-25642 | 8.8 | Aug 25 | ZKConfigurationStore which is optionally used by CapacityScheduler of Apache Hadoop YARN deserializes data obtained from ZooKeeper without validation Affected: 2.9.0 before 2.10.2; 3.0.0 before 3.2.4; 3.3.0 before 3.3.4 |
| CVE-2021-33036 | 8.8 | Jun 15 | In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user Affected: 2.2.0 before 2.10.2; 3.0.1 before 3.2.3; 3.3.0 before 3.3.2; 3.0.0; 3.0.0; 3.0.0; +1 more |
| CVE-2020-9492 | 8.8 | Jan 26 | In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without proper verification Affected: 2.0.0 through 2.10.0; 3.0.0 through 3.1.3; 3.2.0 through 3.2.1 |
| CVE-2018-11764 | 8.8 | Oct 21 | Web endpoint authentication check is broken in Apache Hadoop 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0 Affected: 3.0.0; 3.0.0; 3.0.0 |
| CVE-2018-8029 | 8.8 | May 30 | In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user Affected: 2.2.0 through 2.8.4; 3.0.1 through 3.1.0; 2.9.0; 2.9.1; 3.0.0; 3.0.0; +4 more |
| CVE-2018-11766 | 8.8 | Nov 27 | In Apache Hadoop 2.7.4 to 2.7.6, the security fix for CVE-2016-6811 is incomplete Affected: 2.7.4 through 2.7.6 |
| CVE-2018-8009 | 8.8 | Nov 13 | Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the zip slip vulnerability in places that… Affected: 0.23.0 through 0.23.11; 2.0.0 through 2.7.6; 2.8.0 through 2.8.4; 2.9.0 through 2.9.1; 3.0.0 through 3.0.2; 2.0.0; +6 more |
| CVE-2016-6811 | 8.8 | Apr 11 | In Apache Hadoop 2.x before 2.7.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user Affected: 2.2.0 through 2.7.3 |
| CVE-2016-5393 | 8.8 | Nov 29 | In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with the HDFS NameNode can possibly run arbitrary commands with the same privileges… Affected: 2.7.0; 2.7.1; 2.7.2; 2.6.0; 2.6.1; 2.6.2; +2 more |
| CVE-2015-7430 | 8.4 | Jan 2 | The Hadoop connector 1.1.1, 2.4, 2.5, and 2.7.0-0 before 2.7.0-3 for IBM Spectrum Scale and General Parallel File System (GPFS) allows local users to read or write to arbitrary… Affected: 1.1.1; 2.4.0; 2.5.0; 2.7.0 |
| CVE-2017-3166 | 7.8 | Nov 13 | In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, if a file in an encryption zone with access permissions that make it world readable is localized via… Affected: 2.6.1; 2.6.2; 2.6.3; 2.6.4; 2.6.5; 2.7.0; +4 more |
| CVE-2023-26031 | 7.5 | Nov 16 | Relative library resolution in linux container-executor binary in Apache Hadoop 3.3.1-3.3.4 on Linux allows local user to gain root privileges Affected: 3.3.1 through 3.3.4 |
| CVE-2018-11765 | 7.5 | Sep 30 | In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication when Kerberos authentication is enabled… Affected: 2.8.0 through 2.8.5; 2.9.0 through 2.9.2; 3.0.0; 3.0.0 |
| CVE-2012-2945 | 7.5 | Oct 29 | Hadoop 1.0.3 contains a symlink vulnerability Affected: 1.0.3 |
| CVE-2018-11768 | 7.5 | Oct 4 | In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be corrupted across storing in fsimage and reading… Affected: 2.2.0 through 2.8.4; 2.9.0 through 2.9.1; 3.0.1 through 3.0.3; 3.1.0 through 3.1.1; 2.0.0; 2.0.0; +21 more |
| CVE-2018-1296 | 7.5 | Feb 7 | In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, HDFS exposes extended attribute key/value pairs during listXAttrs, verifying only path-level… Affected: 2.5.0 through 2.7.5; 2.8.0; 2.8.1; 2.8.2; 2.8.3; 2.9.0; +6 more |
| CVE-2017-7669 | 7.5 | Jun 5 | In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation Affected: 2.8.0; 3.0.0; 3.0.0 |
| CVE-2018-11767 | 7.4 | Mar 18 | In Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6, KMS blocking users or granting access to users incorrectly, if the system uses non-default groups mapping… Affected: 2.7.5 through 2.7.6; 2.8.3 through 2.8.4; 2.9.0 through 2.9.1 |
| CVE-2025-27821 | 7.3 | Jan 26 | Out-of-bounds Write vulnerability in Apache Hadoop HDFS native client Affected: 3.2.0 before 3.4.2 |
| CVE-2017-3162 | 7.3 | Apr 26 | HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace Affected: through 2.6.5 |
Showing 20