Описание
This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of HDFS. A local user on an HDFS DataNode may be able to craft a block token that grants unauthorized read access to random files by guessing certain fields in the token.
Ссылки
- Mailing ListThird Party Advisory
- Third Party AdvisoryVDB Entry
- Mailing ListThird Party Advisory
- Third Party AdvisoryVDB Entry
Уязвимые конфигурации
Конфигурация 1Версия до 2.6.3 (включая)
Одно из
cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:hadoop:2.7.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:hadoop:2.7.1:*:*:*:*:*:*:*
EPSS
Процентиль: 31%
0.00118
Низкий
5.5 Medium
CVSS3
2.1 Low
CVSS2
Дефекты
CWE-200
Связанные уязвимости
CVSS3: 5.5
debian
больше 8 лет назад
This is an information disclosure vulnerability in Apache Hadoop befor ...
CVSS3: 5.5
github
больше 3 лет назад
Exposure of Sensitive Information to an Unauthorized Actor in Apache Hadoop
EPSS
Процентиль: 31%
0.00118
Низкий
5.5 Medium
CVSS3
2.1 Low
CVSS2
Дефекты
CWE-200