Exposure of Sensitive Information to an Unauthorized Actor in Hadoop

Description

References

• nvd.nist.gov/vuln/detail/CVE-2018-1296 · ADVISORY
• GitHub Advisory GHSA-v569-g72v-q434 · ADVISORY
• lists.apache.org/thread.html/a5b15bc76fbdad2ee40761aacf954a13aeef67e305f86d483f267e8e@%3Cuser.hadoop.apache.org%3E · WEB
• securityfocus.com/bid/106764 · WEB
• lists.apache.org/thread.html/a5b15bc76fbdad2ee40761aacf954a13aeef67e305f86d483f267e8e%40%3Cuser.hadoop.apache.org%3E

org.apache.hadoop:hadoop-main의 다른 취약점

• CVE-2018-11764높음 8.8Web endpoint authentication check is broken in Apache Hadoop 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0. Authenticated users may impersonate any u…
• CVE-2018-11765높음 7.5In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication w…
• CVE-2012-2945높음 7.5Hadoop 1.0.3 contains a symlink vulnerability.
• CVE-2018-11768높음 7.5In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be corrupte…
• CVE-2018-8029높음 8.8In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run a…