Information Exposure Affecting org.apache.hadoop:hadoop-common Open this link in a new tab package, versions [,2.6.5) [2.7.0,2.7.3)
Attack Complexity
Low
Confidentiality
High
Integrity
High
Availability
High
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications-
snyk-id
SNYK-JAVA-ORGAPACHEHADOOP-30627
-
published
10 Jan 2017
-
disclosed
10 Jan 2017
-
credit
Robert Kante
Introduced: 10 Jan 2017
CVE-2016-3086 Open this link in a new tabOverview
org.apache.hadoop:hadoop-common
is a framework that allows for the distributed processing of large data sets across clusters of computers using simple programming models.
Affected versions of the package are vulnerable to Information Exposure.
If you use the CredentialProvider feature to encrypt passwords used in NodeManager configs, it may be possible for any Container launched by that NodeManager to gain access to the encryption password. The other passwords themselves are not directly exposed.
Remediation
Upgrade org.apache.hadoop:hadoop-common
to versions 2.6.5, 2.7.3 or higher