Exposure of Sensitive Information to an Unauthorized Actor in Apache Hadoop

CRITIQUE 9.8CVE-2016-3086 · GHSA-895m-ww55-59vw · Published 05/09/2017 · updated 17/06/2026

En bref

CVE-2016-3086 est une vulnérabilité CRITIQUE (CVSS 9.8) touchant org.apache.hadoop:hadoop-yarn-server-nodemanager, hadoop (apache).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 3.6%, plus élevée que 89.6% des vulnérabilités.
Correctif : mettre à jour vers 2.6.5, 2.7.3 ou plus récent.

Package	Affected versions	Patched versions
org.apache.hadoop:hadoop-yarn-server-nodemanager Maven	`≥ 2.6.0, < 2.6.5≥ 2.7.0, < 2.7.3`	`2.6.52.7.3`
hadoop apache	`= 2.6.0= 2.6.1= 2.6.2= 2.6.3= 2.6.4= 2.7.0= 2.7.1= 2.7.2`	No fix yet

Description

The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for credential store provider used by the NodeManager to YARN Applications.

NVD description

The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for credential store provider used by the NodeManager to YARN Applications.

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free