user/group information can be corrupted across storing in fsimage and reading back from fsimage

HIGH 7.5CVE-2018-11768 · GHSA-hx83-rpqf-m267 · Published 04/10/2019 · updated 17/06/2026

In short

CVE-2018-11768 is a HIGH (CVSS 7.5) vulnerability affecting org.apache.hadoop:hadoop-main, hadoop (apache).
Chance of exploitation in the next 30 days (EPSS): 6.6%, higher than 93.9% of all vulnerabilities.
Fix: update to 2.8.5, 2.9.2, 3.1.1 or later.

Package	Affected versions	Patched versions
org.apache.hadoop:hadoop-main Maven	`≥ 2.2.0, < 2.8.5≥ 2.9.0, < 2.9.2≥ 3.0.0, < 3.1.1`	`2.8.52.9.23.1.1`
hadoop apache	`= 2.0.0= 2.0.1= 2.0.2= 2.0.3= 2.0.4= 2.0.5= 2.0.6= 2.1.0= 2.1.1= 3.0.0≥ 2.2.0, ≤ 2.8.4≥ 2.9.0, ≤ 2.9.1≥ 3.0.1, ≤ 3.0.3≥ 3.1.0, ≤ 3.1.1`	No fix yet

Description

In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be corrupted across storing in fsimage and reading back from fsimage.

NVD description

In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be corrupted across storing in fsimage and reading back from fsimage.

References

More vulnerabilities in org.apache.hadoop:hadoop-main

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free