En resumen
- CVE-2018-1296 es una vulnerabilidad ALTO (CVSS 7.5) que afecta a org.apache.hadoop:hadoop-main, hadoop (apache).
- Probabilidad de explotación en los próximos 30 días (EPSS): 3.3%, mayor que el 88.6% de las vulnerabilidades.
- Solución: actualizar a 2.8.4, 2.9.1, 2.7.6 o posterior.
| Package | Affected versions | Patched versions |
|---|
| org.apache.hadoop:hadoop-main Maven | ≥ 2.8.0, < 2.8.4≥ 2.9.0, < 2.9.1< 2.7.6
| 2.8.42.9.12.7.6
|
| hadoop | = 2.8.0= 2.8.1= 2.8.2= 2.8.3= 2.9.0= 3.0.0≥ 2.5.0, ≤ 2.7.5
| No fix yet |
Description
In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, HDFS exposes extended attribute key/value pairs during listXAttrs, verifying only path-level search access to the directory rather than path-level read permission to the referent.
NVD description
In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, HDFS exposes extended attribute key/value pairs during listXAttrs, verifying only path-level search access to the directory rather than path-level read permission to the referent.
Más vulnerabilidades de org.apache.hadoop:hadoop-main
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free