| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.hadoop:hadoop-common | ≥ 3.0.0-alpha1, < 3.0.0-alpha3< 2.8.1 | 3.0.0-alpha32.8.1 |
| hadoop | = 2.8.0= 3.0.0 |
In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root. This issue is fixed in versions 2.8.1 and 3.0.0-alpha3.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free