CVE-2012-4449

Published: Oct 30, 2017Modified: May 13, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Apache Hadoop before 0.23.4, 1.x before 1.0.4, and 2.x before 2.0.2 generate token passwords using a 20-bit secret when Kerberos security features are enabled, which makes it easier for context-dependent attackers to crack secret keys via a brute-force attack.

Affected (8)

Products: Apache: Hadoop

Apache

1 product

Hadoop

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Apache Hadoop	Up to 0.23.3
Apache Hadoop	Version 1.0.0
Apache Hadoop	Version 1.0.1
Apache Hadoop	Version 1.0.2
Apache Hadoop	Version 1.0.3
Apache Hadoop	Version 2.0.0 alpha
Apache Hadoop	Version 2.0.1 alpha
Apache Hadoop	Version 2.0.2 alpha

Related CWEs

CWE-327

Use of a Broken or Risky Cryptographic Algorithm

The product uses a broken or risky cryptographic algorithm or protocol.

References (4)

http://mail-archives.apache.org/mod_mbox/hadoop-general/201210.mbox/%3CCA+z3+9FYdPmzBEaMZ71SUqzRx=eU=o4mSHUsbrpzgR9X_F1c0Q%40mail.gmail.com%3E

Source: secalert@redhat.com

https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html#topic_1_0

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

http://mail-archives.apache.org/mod_mbox/hadoop-general/201210.mbox/%3CCA+z3+9FYdPmzBEaMZ71SUqzRx=eU=o4mSHUsbrpzgR9X_F1c0Q%40mail.gmail.com%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html#topic_1_0

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

Timeline

No history available yet.