Client BlockTokens not checked in Apache Hadoop

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2012-3376 · ADVISORY
• apache/hadoop · PACKAGE
• seclists.org/fulldisclosure/2012/Jul/78 · WEB
• cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html · WEB
• archives.neohapsis.com/archives/bugtraq/2012-07/0049.html · WEB
• securityfocus.com/bid/54358

org.apache.hadoop:hadoop-client のその他の脆弱性

• CVE-2012-4449緊急 9.8Apache Hadoop before 0.23.4, 1.x before 1.0.4, and 2.x before 2.0.2 generate token passwords using a 20-bit secret when Kerberos security fe…
• CVE-2017-3162高 7.3HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace. The NameNode is provided as a query parameter that is not…
• CVE-2017-3161中 6.1The HDFS web UI in Apache Hadoop before 2.7.0 is vulnerable to a cross-site scripting (XSS) attack through an unescaped query parameter.
• CVE-2014-3627中 5.0The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote …