Apache Hadoop allows impersonation of arbitrary cluster user accounts

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2012-1574 · ADVISORY
• apache/hadoop · PACKAGE
• seclists.org/fulldisclosure/2012/Apr/70 · WEB
• web.archive.org/web/20120720041621/https://ccp.cloudera.com/display/DOC/Cloudera+Security+Bulletin · WEB
• web.archive.org/web/20151001135054/http://archives.neohapsis.com/archives/bugtraq/2012-04/0051.html · WEB
• web.archive.org/web/20161215212154/https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html · WEB
• web.archive.org/web/20200229125105/http://www.securityfocus.com/bid/52939 · WEB
• archives.neohapsis.com/archives/bugtraq/2012-04/0051.html
• seclists.org/fulldisclosure/2012/Apr/70
• secunia.com/advisories/48775
• secunia.com/advisories/48776
• securityfocus.com/bid/52939
• ccp.cloudera.com/display/DOC/Cloudera+Security+Bulletin · Vendor Advisory
• cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html

org.apache.hadoop:hadoop-main のその他の脆弱性

• CVE-2018-11764高 8.8Web endpoint authentication check is broken in Apache Hadoop 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0. Authenticated users may impersonate any u…
• CVE-2018-11765高 7.5In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication w…
• CVE-2012-2945高 7.5Hadoop 1.0.3 contains a symlink vulnerability.
• CVE-2018-11768高 7.5In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be corrupte…
• CVE-2018-8029高 8.8In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run a…