CVE-2013-2192

Published: Jan 24, 2014Modified: Apr 29, 2026

3.2

Vector

AV:A/AC:H/Au:N/C:P/I:P/A:N

Exploitability: 3.2 / Impact: 4.9

Source: NVD

Description

The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos security features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information by forcing a downgrade to simple authentication.

Affected (23)

Products: Apache: Hadoop

Apache

1 product

Hadoop

Configuration A

23 vulnerable

Vulnerable Software	Affected Versions
Apache Hadoop	Version 0.23.0
Apache Hadoop	Version 0.23.1
Apache Hadoop	Version 0.23.3
Apache Hadoop	Version 0.23.4
Apache Hadoop	Version 0.23.5
Apache Hadoop	Version 0.23.6
Apache Hadoop	Version 0.23.7
Apache Hadoop	Version 0.23.8
Apache Hadoop	Version 1.0.0
Apache Hadoop	Version 1.0.1
Apache Hadoop	Version 1.0.2
Apache Hadoop	Version 1.0.3
Apache Hadoop	Version 1.0.4
Apache Hadoop	Version 1.1.0
Apache Hadoop	Version 1.1.1
Apache Hadoop	Version 1.1.2
Apache Hadoop	Version 1.2.0
Apache Hadoop	Version 2.0.0 alpha
Apache Hadoop	Version 2.0.1 alpha
Apache Hadoop	Version 2.0.2 alpha
Apache Hadoop	Version 2.0.3 alpha
Apache Hadoop	Version 2.0.4 alpha
Apache Hadoop	Version 2.0.5 alpha