CVE-2017-15713 Moderate severity vulnerability that affects org.apache.hadoop:hadoop-main
MediumCVSS 6.5
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Vulnerability in Apache Hadoop 0.23.x, 2.x before 2.7.5, 2.8.x before 2.8.3, and 3.0.0-alpha through 3.0.0-beta1 allows a cluster user to expose private files owned by the user running the MapReduce job history server process. The malicious user can construct a configuration file containing XML directives that reference sensitive files on the MapReduce job history server host.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.hadoop/hadoop-main(Maven) | < 2.7.5 | 2.7.5 |
| org.apache.hadoop/hadoop-main(Maven) | >= 2.8.0, < 2.8.3 | 2.8.3 |
| org.apache.hadoop/hadoop-main(Maven) | = 0.23.1 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 0.23.10 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 0.23.11 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 0.23.3 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 0.23.4 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 0.23.5 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 0.23.6 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 0.23.7 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 0.23.8 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 0.23.9 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.0.0-alpha | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.0.1-alpha | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.0.2-alpha | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.0.3-alpha | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.0.4-alpha | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.0.5-alpha | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.0.6-alpha | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.1.0-beta | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.1.1-beta | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.2.0 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.3.0 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.4.0 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.4.1 | No fix listed |
Show 36 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.hadoop/hadoop-main(Maven) | = 2.5.0 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.5.1 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.5.2 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.6.0 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.6.1 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.6.2 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.6.3 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.6.4 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.6.5 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.7.0 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.7.1 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.7.2 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.7.3 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.7.4 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.8.0 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.8.1 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.8.2 | No fix listed |
| apache hadoop | >= 0.23.0, <= 0.23.11 | No fix listed |
| apache hadoop | >= 2.2.0, <= 2.8.2 | No fix listed |
| apache hadoop | = 2.0.0-alpha | No fix listed |
| apache hadoop | = 2.0.1-alpha | No fix listed |
| apache hadoop | = 2.0.2-alpha | No fix listed |
| apache hadoop | = 2.0.3-alpha | No fix listed |
| apache hadoop | = 2.0.4-alpha | No fix listed |
| apache hadoop | = 2.0.5-alpha | No fix listed |
| apache hadoop | = 2.0.6-alpha | No fix listed |
| apache hadoop | = 2.1.0-beta | No fix listed |
| apache hadoop | = 2.1.1-beta | No fix listed |
| apache hadoop | = 3.0.0-alpha1 | No fix listed |
| apache hadoop | = 3.0.0-alpha2 | No fix listed |
| apache hadoop | = 3.0.0-alpha3 | No fix listed |
| apache hadoop | = 3.0.0-alpha4 | No fix listed |
| apache hadoop | = 3.0.0-beta1 | No fix listed |
| Apache Hadoop | = 0.23.0 to 0.23.11 | No fix listed |
| Apache Hadoop | = 2.0.0-alpha to 2.8.2 | No fix listed |
| Apache Hadoop | = 3.0.0-alpha to 3.0.0-beta1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com vendor-advisory
- lists.apache.org
- [general] 20180119 CVE-2017-15713: Apache Hadoop MapReduce job history server vulnerability mailing-list