org.apache.hadoop:hadoop-common@2.0.0-alpha vulnerabilities
-
latest version
3.4.1
-
latest non vulnerable version
-
first published
13 years ago
-
latest version published
a month ago
-
licenses detected
- [0,)
-
package manager
Direct Vulnerabilities
Known vulnerabilities in the org.apache.hadoop:hadoop-common package. This does not include vulnerabilities belonging to this package’s dependencies.
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.| Vulnerability | Vulnerable Version |
|---|---|
org.apache.hadoop:hadoop-common is a framework that allows for the distributed processing of large data sets across clusters of computers using simple programming models. Affected versions of this package are vulnerable to Creation of Temporary File in Directory with Insecure Permissions in the Note: This vulnerability can only be exploited on unix-like systems, where the system temporary directory is shared between all local users. How to fix Creation of Temporary File in Directory with Insecure Permissions? Upgrade |
[,3.4.0)
|
org.apache.hadoop:hadoop-common is a framework that allows for the distributed processing of large data sets across clusters of computers using simple programming models. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) in How to fix Arbitrary File Write via Archive Extraction (Zip Slip)? Upgrade |
[,2.10.2)
[3.0.0-alpha1,3.2.3)
[3.3.0,3.3.3-RC0)
|
org.apache.hadoop:hadoop-common is a framework that allows for the distributed processing of large data sets across clusters of computers using simple programming models. Affected versions of this package are vulnerable to Information Exposure. A cluster user may be able to expose private files owned by the user running the MapReduce job history server process. A malicious user can construct a configuration file containing XML directives that reference sensitive files on the MapReduce job history server host. How to fix Information Exposure? Upgrade |
[,2.8.3)
[3.0.0-alpha,3.0.0)
|
org.apache.hadoop:hadoop-common is a framework that allows for the distributed processing of large data sets across clusters of computers using simple programming models. Affected versions of this package are vulnerable to Cryptographic Weakness due to an insufficient secret key length. The package generates token passwords using a 20-bit secret when Kerberos security features are enabled, which makes it easier for context-dependent attackers to crack secret keys via a brute-force attack. How to fix Cryptographic Weakness? Upgrade |
[,0.23.4)
[2.0.0-alpha,2.0.2-alpha)
|
Affected versions of the package are vulnerable to Information Exposure. If you use the CredentialProvider feature to encrypt passwords used in NodeManager configs, it may be possible for any Container launched by that NodeManager to gain access to the encryption password. The other passwords themselves are not directly exposed. How to fix Information Exposure? Upgrade |
[,2.6.5)
[2.7.0,2.7.3)
|