org.apache.hadoop:hadoop-common@2.0.1-alpha vulnerabilities

org.apache.hadoop:hadoop-common is a framework that allows for the distributed processing of large data sets across clusters of computers using simple programming models.

Affected versions of this package are vulnerable to Creation of Temporary File in Directory with Insecure Permissions in the RunJar.run() method. If sensitive data is stored in this file, a local attacker can view it by accessing the temporary directory where this data is stored.

Note:

This vulnerability can only be exploited on unix-like systems, where the system temporary directory is shared between all local users.

Upgrade org.apache.hadoop:hadoop-common to version 3.4.0 or higher.

org.apache.hadoop:hadoop-common is a framework that allows for the distributed processing of large data sets across clusters of computers using simple programming models.

Affected versions of this package are vulnerable to Arbitrary Code Execution via the FileUtil.unTar() API due to improper escape of the input file name before it passed to the shell.

Note:

In vulnerable 3.3.x versions FileUtil.unTar() is used through InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user.

Upgrade org.apache.hadoop:hadoop-common to version 2.10.2, 3.2.4, 3.3.3 or higher.

org.apache.hadoop:hadoop-common is a framework that allows for the distributed processing of large data sets across clusters of computers using simple programming models.

Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) in FileUtil where unpackEntries during TAR extraction follows symbolic links which allows writing outside the expected base directory on Windows. This is because getCanonicalPath doesn't resolve symbolic links on Windows.

Upgrade org.apache.hadoop:hadoop-common to version 2.10.2, 3.2.3, 3.3.3-RC0 or higher.

org.apache.hadoop:hadoop-common is a framework that allows for the distributed processing of large data sets across clusters of computers using simple programming models.

Affected versions of this package are vulnerable to Information Exposure. A cluster user may be able to expose private files owned by the user running the MapReduce job history server process. A malicious user can construct a configuration file containing XML directives that reference sensitive files on the MapReduce job history server host.

Upgrade org.apache.hadoop:hadoop-common to version 2.8.3, 3.0.0 or higher.

org.apache.hadoop:hadoop-common is a framework that allows for the distributed processing of large data sets across clusters of computers using simple programming models.

Affected versions of this package are vulnerable to Cryptographic Weakness due to an insufficient secret key length. The package generates token passwords using a 20-bit secret when Kerberos security features are enabled, which makes it easier for context-dependent attackers to crack secret keys via a brute-force attack.

Upgrade org.apache.hadoop:hadoop-common to version 0.23.4, 2.0.2-alpha or higher.

org.apache.hadoop:hadoop-common is a framework that allows for the distributed processing of large data sets across clusters of computers using simple programming models.

Affected versions of the package are vulnerable to Information Exposure.

If you use the CredentialProvider feature to encrypt passwords used in NodeManager configs, it may be possible for any Container launched by that NodeManager to gain access to the encryption password. The other passwords themselves are not directly exposed.

Upgrade org.apache.hadoop:hadoop-common to versions 2.6.5, 2.7.3 or higher