CVE-2021-25642

Published: Aug 25, 2022Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

ZKConfigurationStore which is optionally used by CapacityScheduler of Apache Hadoop YARN deserializes data obtained from ZooKeeper without validation. An attacker having access to ZooKeeper can run arbitrary commands as YARN user by exploiting this. Users should upgrade to Apache Hadoop 2.10.2, 3.2.4, 3.3.4 or later (containing YARN-11126) if ZKConfigurationStore is used.

Affected (3)

Products: Apache: Hadoop

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Apache Hadoop	From 2.9.0 to 2.10.2
Apache Hadoop	From 3.0.0 to 3.2.4
Apache Hadoop	From 3.3.0 to 3.3.4

Related CWEs

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (4)

https://lists.apache.org/thread/g6vf2h4wdgzzdgk91mqozhs58wotq150

Source: security@apache.org

Mailing ListVendor Advisory

https://security.netapp.com/advisory/ntap-20221201-0003/

Source: security@apache.org

Third Party Advisory

https://lists.apache.org/thread/g6vf2h4wdgzzdgk91mqozhs58wotq150

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListVendor Advisory

https://security.netapp.com/advisory/ntap-20221201-0003/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.