High Hadoop CVEs
21 CVEs, 1 exploited, 4 protected by Waratek
Overview 21 matches · 4 protected · 1 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
Protected by Waratek
4
19.0%
Rule in development
0
0.0%
Mitigation candidate
1
4.8%
No exploit published
16
76.2%
blocked by ARMR today
4
19.0%
partly blocked
0
0.0%
not blocked
17
81.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
1
4.8%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
20
95.2%
split by
peak 5 / year
20121
No exploit published1
High1
not blocked1
No public exploit1
20130
20140
20150
20161
No exploit published1
High1
not blocked1
No public exploit1
20174
No exploit published4
High4
not blocked4
No public exploit4
20182
Protected by Waratek1
No exploit published1
High2
blocked by ARMR today1
not blocked1
No public exploit2
20195
No exploit published5
High5
not blocked5
No public exploit5
20202
No exploit published2
High2
not blocked2
No public exploit2
20212
No exploit published2
High2
not blocked2
No public exploit2
20222
Protected by Waratek2
High2
blocked by ARMR today2
No public exploit2
20232
Protected by Waratek1
Mitigation candidate1
High2
blocked by ARMR today1
not blocked1
Exploited1
No public exploit1
201220132014201520162017201820192020202120222023
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2023-46674 | High | 2023-12-05 | Protected by Waratek | No public exploit | An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by authenticated users. Elastic would like to thank Yakov Shafranovich, with Amazon Web Services for reporting this issue. |
| CVE-2023-36542 | High | 2023-07-29 | Mitigation candidate | Exploited | Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission for referencing remote resources, restricting configuration of these components to privileged users. The permission prevents unprivileged users from configuring Processors and Controller Services annotated with the new Reference Remote Resources restriction. Upgrading to Apache NiFi 1.23.0 is the recommended mitigation. |
| CVE-2021-25642 | High | 2022-08-25 | Protected by Waratek | No public exploit | ZKConfigurationStore which is optionally used by CapacityScheduler of Apache Hadoop YARN deserializes data obtained from ZooKeeper without validation. An attacker having access to ZooKeeper can run arbitrary commands as YARN user by exploiting this. Users should upgrade to Apache Hadoop 2.10.2, 3.2.4, 3.3.4 or later (containing YARN-11126) if ZKConfigurationStore is used. |
| CVE-2021-33036 | High | 2022-06-15 | Protected by Waratek | No public exploit | In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher. |
| CVE-2021-39236 | High | 2021-11-19 | No exploit published | No public exploit | In Apache Ozone before 1.2.0, Authenticated users with valid Ozone S3 credentials can create specific OM requests, impersonating any other user. |
| CVE-2020-9492 | High | 2021-01-26 | No exploit published | No public exploit | In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without proper verification. |
| CVE-2018-11764 | High | 2020-10-21 | No exploit published | No public exploit | Web endpoint authentication check is broken in Apache Hadoop 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0. Authenticated users may impersonate any user even if no proxy user is configured. |
| CVE-2018-11765 | High | 2020-09-30 | No exploit published | No public exploit | In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication when Kerberos authentication is enabled and SPNEGO through HTTP is not enabled. |
| CVE-2012-2945 | High | 2019-10-29 | No exploit published | No public exploit | Hadoop 1.0.3 contains a symlink vulnerability. |
| CVE-2018-11768 | High | 2019-10-04 | No exploit published | No public exploit | In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be corrupted across storing in fsimage and reading back from fsimage. |
| CVE-2018-8029 | High | 2019-05-30 | No exploit published | No public exploit | In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user. |
| CVE-2018-11767 | High | 2019-03-21 | No exploit published | No public exploit | In Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6, KMS blocking users or granting access to users incorrectly, if the system uses non-default groups mapping mechanisms. |
| CVE-2018-1296 | High | 2019-02-07 | No exploit published | No public exploit | In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, HDFS exposes extended attribute key/value pairs during listXAttrs, verifying only path-level search access to the directory rather than path-level read permission to the referent. |
| CVE-2018-11766 | High | 2018-11-27 | No exploit published | No public exploit | In Apache Hadoop 2.7.4 to 2.7.6, the security fix for CVE-2016-6811 is incomplete. A user who can escalate to yarn user can possibly run arbitrary commands as root user. |
| CVE-2018-8009 | High | 2018-11-13 | Protected by Waratek | No public exploit | Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the zip slip vulnerability in places that accept a zip file. |
| CVE-2017-3166 | High | 2017-11-13 | No exploit published | No public exploit | In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, if a file in an encryption zone with access permissions that make it world readable is localized via YARN's localization mechanism, that file will be stored in a world-readable location and can be shared freely with any application that requests to localize that file. |
| CVE-2017-7669 | High | 2017-06-05 | No exploit published | No public exploit | In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root. |
| CVE-2017-3162 | High | 2017-04-26 | No exploit published | No public exploit | HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace. The NameNode is provided as a query parameter that is not validated in Apache Hadoop before 2.7.0. |
| CVE-2016-6811 | High | 2017-04-11 | No exploit published | No public exploit | In Apache Hadoop 2.x before 2.7.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user. |
| CVE-2016-5393 | High | 2016-11-29 | No exploit published | No public exploit | In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with the HDFS NameNode can possibly run arbitrary commands with the same privileges as the HDFS service. |
| CVE-2012-3376 | High | 2012-07-12 | No exploit published | No public exploit | DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have read access, and have other unspecified impacts. |