ALT-PU-2017-3659: package hadoop update to version 2.7.3-alt1_2jpp8
Описание
This update upgrades hadoop to version 2.7.3-alt1_2jpp8.
Устраненные уязвимости4
Ссылки5
GHSA-8r28-r8cp-g6cp
https://github.com/advisories/GHSA-8r28-r8cp-g6cpGHSA-jpmf-8cj2-595g
https://github.com/advisories/GHSA-jpmf-8cj2-595gGHSA-pr9x-qmp5-j3rr
https://github.com/advisories/GHSA-pr9x-qmp5-j3rrGHSA-qm7f-r83w-3p46
https://github.com/advisories/GHSA-qm7f-r83w-3p46Связанные уязвимости
The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote cluster users to change the permissions of certain files to world-readable via a symlink attack in a public tar archive, which is not properly handled during localization, related to distributed cache.
The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote cluster users to change the permissions of certain files to world-readable via a symlink attack in a public tar archive, which is not properly handled during localization, related to distributed cache.
Improper Link Resolution Before File Access in Apache Hadoop
This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of HDFS. A local user on an HDFS DataNode may be able to craft a block token that grants unauthorized read access to random files by guessing certain fields in the token.
This is an information disclosure vulnerability in Apache Hadoop befor ...