| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.hadoop:hadoop-yarn-server-common | ≥ 2.2.0, < 2.10.2≥ 3.0.0, < 3.2.3≥ 3.3.0, < 3.3.2 | 2.10.23.2.33.3.2 |
| hadoop | = 3.0.0≥ 2.2.0, < 2.10.2≥ 3.0.1, < 3.2.3≥ 3.3.0, < 3.3.2 | 2.10.23.2.33.3.2 |
In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free