Information Exposure Affecting org.apache.hadoop:hadoop-mapreduce-client-core Open this link in a new tab package, versions [2.6.0, 2.7.1)


0.0
medium
  • Attack Complexity

    Low

  • Confidentiality

    High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id

    SNYK-JAVA-ORGAPACHEHADOOP-30634

  • published

    16 Feb 2016

  • disclosed

    16 Feb 2016

  • credit

    Unknown

How to fix?

Upgrade org.apache.hadoop:hadoop-mapreduce-client-core to version 2.7.1 or higher.

Overview

org.apache.hadoop:hadoop-mapreduce-client-core is a framework that allows for the distributed processing of large data sets across clusters of computers using simple programming models.

Affected versions of this package are vulnerable to Information Exposure. It encrypts intermediate data generated by a MapReduce job and stores it along with the encryption key in a credentials file on disk when the Intermediate data encryption feature is enabled, which allows local users to obtain sensitive information by reading the file.

References