Arbitrary Code Execution Affecting org.apache.hadoop:hadoop-common package, versions [2.0.0,2.10.2) [3.0.0-alpha, 3.2.4) [3.3.0, 3.3.3)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGAPACHEHADOOP-2975400
- published 5 Aug 2022
- disclosed 5 Aug 2022
- credit Kostya Kortchinskyn
Introduced: 5 Aug 2022
CVE-2022-25168 Open this link in a new tabHow to fix?
Upgrade org.apache.hadoop:hadoop-common to version 2.10.2, 3.2.4, 3.3.3 or higher.
Overview
org.apache.hadoop:hadoop-common is a framework that allows for the distributed processing of large data sets across clusters of computers using simple programming models.
Affected versions of this package are vulnerable to Arbitrary Code Execution via the FileUtil.unTar() API due to improper escape of the input file name before it passed to the shell.
Note:
In vulnerable 3.3.x versions FileUtil.unTar() is used through InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user.