HIGH✓ PATCH🇬🇧 English

CVE-2021-33036

CVSS 8.8v3.1pub. 2022-06-15upd. 2024-11-21

In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Apache Hadoop

    APP
    Apache
    3.0.02.2.0 – 2.10.2 (bez)3.0.1 – 3.2.3 (bez)3.3.0 – 3.3.2 (bez)
🟢
PATCH DOSTĘPNY
Aktualizacja od producenta gotowa. Wdrożenie w ramach standardowego cyklu.
Tagi
Path Traversal
CWE
Referencje

Powiązane podatności

CVE-2022-25168CRITICAL9.8ten sam produkt

Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the ...

CVE-2021-37404CRITICAL9.8ten sam produkt

There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided b...

CVE-2022-26612CRITICAL9.8ten sam produkt

In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on U...

CVE-2019-17195CRITICAL9.8ten sam produkt

Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could ...

CVE-2017-15718CRITICAL9.8ten sam produkt

The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used...