Homepage About Snyk

Information Exposure Affecting org.apache.hadoop:hadoop-mapreduce-client-app package, versions [2.6.0, 2.7.1)

0.0
medium

  • Attack Complexity

    Low

  • Confidentiality

    High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

  • snyk-id

    SNYK-JAVA-ORGAPACHEHADOOP-30633

  • published

    16 Feb 2016

  • disclosed

    16 Feb 2016

  • credit

    Unknown

Report a new vulnerability Found a mistake?

Introduced: 16 Feb 2016

CVE-2015-1776 Open this link in a new tab
CWE-200 Open this link in a new tab

How to fix?

Upgrade org.apache.hadoop:hadoop-mapreduce-client-app to version 2.7.1 or higher.

Overview

org.apache.hadoop:hadoop-mapreduce-client-app is a software framework for distributed processing of large data sets on compute clusters of commodity hardware.

Affected versions of this package are vulnerable to Information Exposure. It encrypts intermediate data generated by a MapReduce job and stores it along with the encryption key in a credentials file on disk when the Intermediate data encryption feature is enabled, which allows local users to obtain sensitive information by reading the file.

References