| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.hadoop:hadoop-common | ≥ 0.23.0, < 0.23.9≥ 2.0.0, < 2.0.6-alpha | 0.23.92.0.6-alpha |
| hadoop | = 0.23.0= 0.23.1= 0.23.3= 0.23.4= 0.23.5= 0.23.6= 0.23.7= 0.23.8= 1.0.0= 1.0.1= 1.0.2= 1.0.3= 1.0.4= 1.1.0= 1.1.1= 1.1.2= 1.2.0= 2.0.0= 2.0.1= 2.0.2= 2.0.3= 2.0.4= 2.0.5 |
The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos security features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information by forcing a downgrade to simple authentication.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free