CVE-2021-37404

Published: Jun 13, 2022Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may result in a denial of service or arbitrary code execution. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.

Affected (4)

Products: Apache: Hadoop

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Apache Hadoop	From 2.9.0 to 2.10.2
Apache Hadoop	From 3.0.0 to 3.1.4
Apache Hadoop	From 3.2.0 to 3.2.3
Apache Hadoop	From 3.3.0 to 3.3.2

Related CWEs

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (4)

https://lists.apache.org/thread/2h56ztcj3ojc66qzf1nno88vjw9vd4wo

Source: security@apache.org

Mailing List

https://security.netapp.com/advisory/ntap-20220715-0007/

Source: security@apache.org

Third Party Advisory

https://lists.apache.org/thread/2h56ztcj3ojc66qzf1nno88vjw9vd4wo

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

https://security.netapp.com/advisory/ntap-20220715-0007/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.