Exposure of Sensitive Information in Hadoop

CRITICO 9.8CVE-2017-15718 · GHSA-mq8p-h798-xcrp · Published 24/01/2018 · updated 17/06/2026

In breve

CVE-2017-15718 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda org.apache.hadoop:hadoop-main, hadoop (apache).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 3.6%, superiore al 89.4% delle vulnerabilità.
Correzione: aggiornare a 2.7.5 o successiva.

Package	Affected versions	Patched versions
org.apache.hadoop:hadoop-main Maven	`≥ 2.7.3, < 2.7.5`	`2.7.5`
hadoop apache	`= 2.7.3= 2.7.4`	No fix yet

Description

The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications.

NVD description

The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications.

References

Altre vulnerabilità di org.apache.hadoop:hadoop-main

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.apache.hadoop:hadoop-main

Maven

≥ 2.7.3, < 2.7.5

2.7.5

hadoop

apache

= 2.7.3= 2.7.4

No fix yet

Description

The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications.

NVD description

The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications.

Altre vulnerabilità di org.apache.hadoop:hadoop-main

Vedi tutto →