Поиск уязвимостей

ALT-PU-2017-3659: package `hadoop` update to version 2.7.3-alt1_2jpp8

The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote cluster users to change the permissions of certain files to world-readable via a symlink attack in a public tar archive, which is not properly handled during localization, related to distributed cache.

The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote cluster users to change the permissions of certain files to world-readable via a symlink attack in a public tar archive, which is not properly handled during localization, related to distributed cache.

Improper Link Resolution Before File Access in Apache Hadoop

This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of HDFS. A local user on an HDFS DataNode may be able to craft a block token that grants unauthorized read access to random files by guessing certain fields in the token.

This is an information disclosure vulnerability in Apache Hadoop befor ...

Exposure of Sensitive Information to an Unauthorized Actor in Apache Hadoop

HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace. The NameNode is provided as a query parameter that is not validated in Apache Hadoop before 2.7.0.

HDFS clients interact with a servlet on the DataNode to browse the HDF ...

The HDFS web UI in Apache Hadoop before 2.7.0 is vulnerable to a cross-site scripting (XSS) attack through an unescaped query parameter.

The HDFS web UI in Apache Hadoop before 2.7.0 is vulnerable to a cross ...

Improper Neutralization of Input During Web Page Generation in Apache Hadoop

Improper Input Validation in Apache Hadoop