CVE-2018-1296

Published: Feb 7, 2019Modified: Nov 21, 2024

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, HDFS exposes extended attribute key/value pairs during listXAttrs, verifying only path-level search access to the directory rather than path-level read permission to the referent.

Affected (12)

Products: Apache: Hadoop

Apache

1 product

Hadoop

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Apache Hadoop	From 2.5.0 to 2.7.5
Apache Hadoop	Version 2.8.0
Apache Hadoop	Version 2.8.1
Apache Hadoop	Version 2.8.2
Apache Hadoop	Version 2.8.3
Apache Hadoop	Version 2.9.0
Apache Hadoop	Version 3.0.0
Apache Hadoop	Version 3.0.0 alpha1
Apache Hadoop	Version 3.0.0 alpha2
Apache Hadoop	Version 3.0.0 alpha3
Apache Hadoop	Version 3.0.0 alpha4
Apache Hadoop	Version 3.0.0 beta1

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (4)

http://www.securityfocus.com/bid/106764

Source: security@apache.org

Third Party Advisory

https://lists.apache.org/thread.html/a5b15bc76fbdad2ee40761aacf954a13aeef67e305f86d483f267e8e%40%3Cuser.hadoop.apache.org%3E

Source: security@apache.org

http://www.securityfocus.com/bid/106764

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://lists.apache.org/thread.html/a5b15bc76fbdad2ee40761aacf954a13aeef67e305f86d483f267e8e%40%3Cuser.hadoop.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.