org.apache.hadoop:hadoop-common@3.3.1 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the org.apache.hadoop:hadoop-common package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • C
Arbitrary Code Execution

org.apache.hadoop:hadoop-common is a framework that allows for the distributed processing of large data sets across clusters of computers using simple programming models.

Affected versions of this package are vulnerable to Arbitrary Code Execution via the FileUtil.unTar() API due to improper escape of the input file name before it passed to the shell.

Note:

In vulnerable 3.3.x versions FileUtil.unTar() is used through InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user.

How to fix Arbitrary Code Execution?

Upgrade org.apache.hadoop:hadoop-common to version 2.10.2, 3.2.4, 3.3.3 or higher.

[2.0.0,2.10.2) [3.0.0-alpha,3.2.4) [3.3.0,3.3.3)
  • C
Arbitrary File Write via Archive Extraction (Zip Slip)

org.apache.hadoop:hadoop-common is a framework that allows for the distributed processing of large data sets across clusters of computers using simple programming models.

Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) in FileUtil where unpackEntries during TAR extraction follows symbolic links which allows writing outside the expected base directory on Windows. This is because getCanonicalPath doesn't resolve symbolic links on Windows.

How to fix Arbitrary File Write via Archive Extraction (Zip Slip)?

Upgrade org.apache.hadoop:hadoop-common to version 2.10.2, 3.2.3, 3.3.3-RC0 or higher.

[,2.10.2) [3.0.0-alpha1,3.2.3) [3.3.0,3.3.3-RC0)