Information Exposure Affecting org.apache.hadoop:hadoop-mapreduce-client-app Open this link in a new tab package, versions [2.6.0, 2.7.1)
Attack Complexity
Low
Confidentiality
High
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications-
snyk-id
SNYK-JAVA-ORGAPACHEHADOOP-30633
-
published
16 Feb 2016
-
disclosed
16 Feb 2016
-
credit
Unknown
Introduced: 16 Feb 2016
CVE-2015-1776 Open this link in a new tabHow to fix?
Upgrade org.apache.hadoop:hadoop-mapreduce-client-app
to version 2.7.1 or higher.
Overview
org.apache.hadoop:hadoop-mapreduce-client-app is a software framework for distributed processing of large data sets on compute clusters of commodity hardware.
Affected versions of this package are vulnerable to Information Exposure. It encrypts intermediate data generated by a MapReduce job and stores it along with the encryption key in a credentials file on disk when the Intermediate data encryption feature is enabled, which allows local users to obtain sensitive information by reading the file.