CVE-2015-1776

Published: Apr 19, 2016Modified: May 6, 2026

6.2

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.5 / Impact: 3.6

Source: NVD

Description

Apache Hadoop 2.6.x encrypts intermediate data generated by a MapReduce job and stores it along with the encryption key in a credentials file on disk when the Intermediate data encryption feature is enabled, which allows local users to obtain sensitive information by reading the file.

Affected (5)

Products: Apache: Hadoop

1 product

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Apache Hadoop	Version 2.6.0
Apache Hadoop	Version 2.6.1
Apache Hadoop	Version 2.6.2
Apache Hadoop	Version 2.6.3
Apache Hadoop	Version 2.6.4

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (4)

http://mail-archives.apache.org/mod_mbox/hadoop-general/201602.mbox/%3CCAGCyb56CPgQMcxZ7jP87SfM5OKGx+E49DtrzCTQ6+nQf2a4nSA%40mail.gmail.com%3E

Source: secalert@redhat.com

http://www.securityfocus.com/bid/83259

Source: secalert@redhat.com

http://mail-archives.apache.org/mod_mbox/hadoop-general/201602.mbox/%3CCAGCyb56CPgQMcxZ7jP87SfM5OKGx+E49DtrzCTQ6+nQf2a4nSA%40mail.gmail.com%3E

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/83259

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.