CVE-2017-3166 Moderate severity vulnerability that affects org.apache.hadoop:hadoop-main
HighCVSS 7.8
EPSS 0.32%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, if a file in an encryption zone with access permissions that make it world readable is localized via YARN's localization mechanism, that file will be stored in a world-readable location and can be shared freely with any application that requests to localize that file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.hadoop/hadoop-main(Maven) | < 2.7.3 | 2.7.3 |
| org.apache.hadoop/hadoop-main(Maven) | = 0.23.1 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 0.23.10 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 0.23.11 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 0.23.3 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 0.23.4 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 0.23.5 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 0.23.6 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 0.23.7 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 0.23.8 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 0.23.9 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.0.0-alpha | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.0.1-alpha | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.0.2-alpha | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.0.3-alpha | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.0.4-alpha | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.0.5-alpha | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.0.6-alpha | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.1.0-beta | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.1.1-beta | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.2.0 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.3.0 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.4.0 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.4.1 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.5.0 | No fix listed |
Show 24 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.hadoop/hadoop-main(Maven) | = 2.5.1 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.5.2 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.6.0 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.6.1 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.6.2 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.6.3 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.6.4 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.6.5 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.7.0 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.7.1 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.7.2 | No fix listed |
| apache hadoop | = 2.6.1 | No fix listed |
| apache hadoop | = 2.6.2 | No fix listed |
| apache hadoop | = 2.6.3 | No fix listed |
| apache hadoop | = 2.6.4 | No fix listed |
| apache hadoop | = 2.6.5 | No fix listed |
| apache hadoop | = 2.7.0 | No fix listed |
| apache hadoop | = 2.7.1 | No fix listed |
| apache hadoop | = 2.7.2 | No fix listed |
| apache hadoop | = 2.7.3 | No fix listed |
| apache hadoop | = 3.0.0-alpha1 | No fix listed |
| Apache Hadoop | = 2.6.1 to 2.6.5 | No fix listed |
| Apache Hadoop | = 2.7.0 to 2.7.3 | No fix listed |
| Apache Hadoop | = 3.0.0-alpha1 to 3.0.0-alpha3 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com vendor-advisory
- lists.apache.org
- lists.apache.org
- [general] 20171108 [SECURITY] CVE-2017-3166: Apache Hadoop Privilege escalation vulnerability mailing-list
- [druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities mailing-list