| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.hadoop:hadoop-main | < 2.7.3 | 2.7.3 |
| hadoop | = 2.6.1= 2.6.2= 2.6.3= 2.6.4= 2.6.5= 2.7.0= 2.7.1= 2.7.2= 2.7.3= 3.0.0 |
In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, if a file in an encryption zone with access permissions that make it world readable is localized via YARN's localization mechanism, that file will be stored in a world-readable location and can be shared freely with any application that requests to localize that file.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free