CVE-2014-3627

Опубликовано: 05 дек. 2014

Источник: nvd

CVSS2: 5

EPSS Низкий

Описание

The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote cluster users to change the permissions of certain files to world-readable via a symlink attack in a public tar archive, which is not properly handled during localization, related to distributed cache.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:hadoop:0.23.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:hadoop:0.23.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:hadoop:0.23.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:hadoop:0.23.4:*:*:*:*:*:*:*

cpe:2.3:a:apache:hadoop:0.23.5:*:*:*:*:*:*:*

cpe:2.3:a:apache:hadoop:0.23.6:*:*:*:*:*:*:*

cpe:2.3:a:apache:hadoop:0.23.7:*:*:*:*:*:*:*

cpe:2.3:a:apache:hadoop:0.23.8:*:*:*:*:*:*:*

cpe:2.3:a:apache:hadoop:0.23.9:*:*:*:*:*:*:*

cpe:2.3:a:apache:hadoop:0.23.10:*:*:*:*:*:*:*

cpe:2.3:a:apache:hadoop:0.23.11:*:*:*:*:*:*:*

cpe:2.3:a:apache:hadoop:2.0.0:alpha:*:*:*:*:*:*

cpe:2.3:a:apache:hadoop:2.0.1:alpha:*:*:*:*:*:*

cpe:2.3:a:apache:hadoop:2.0.2:alpha:*:*:*:*:*:*

cpe:2.3:a:apache:hadoop:2.0.3:alpha:*:*:*:*:*:*

cpe:2.3:a:apache:hadoop:2.0.4:alpha:*:*:*:*:*:*

cpe:2.3:a:apache:hadoop:2.0.5:alpha:*:*:*:*:*:*

cpe:2.3:a:apache:hadoop:2.0.6:alpha:*:*:*:*:*:*

cpe:2.3:a:apache:hadoop:2.1.0:beta:*:*:*:*:*:*

cpe:2.3:a:apache:hadoop:2.1.1:beta:*:*:*:*:*:*

cpe:2.3:a:apache:hadoop:2.2.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:hadoop:2.3.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:hadoop:2.4.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:hadoop:2.4.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:hadoop:2.5.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:hadoop:2.5.1:*:*:*:*:*:*:*

EPSS

Процентиль: 81%

0.01616

Низкий

5 Medium

CVSS2

Дефекты

CWE-59

Связанные уязвимости

CVE-2014-3627

redhat

около 11 лет назад

GHSA-jpmf-8cj2-595g

github

больше 3 лет назад

Improper Link Resolution Before File Access in Apache Hadoop