CVE-2024-23454

Published: Sep 25, 2024Modified: Jun 17, 2026

6.2

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.5 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local users. As such, files written in this directory, without setting the correct posix permissions explicitly, may be viewable by all other local users.

Affected (1)

Products: Apache: Hadoop

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Hadoop	Before 3.4.0

Related CWEs

Creation of Temporary File With Insecure Permissions

Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.

References (4)

https://issues.apache.org/jira/browse/HADOOP-19031

Source: security@apache.org

PatchVendor Advisory

https://lists.apache.org/thread/xlo7q8kn4tsjvx059r789oz19hzgfkfs

Source: security@apache.org

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2024/09/25/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://security.netapp.com/advisory/ntap-20241101-0002/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.