org.apache.hadoop:hadoop-main (Maven) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Maven package org.apache.hadoop:hadoop-main, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (13)

• CVE-2017-15718 — CVSS 9.8 (critical): The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN…
• CVE-2018-8009 — CVSS 8.8 (high): Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the…
• CVE-2018-11766 — CVSS 8.8 (high): In Apache Hadoop 2.7.4 to 2.7.6, the security fix for CVE-2016-6811 is incomplete. A user who can escalate to yarn user can possibly run…
• CVE-2018-8029 — CVSS 8.8 (high): In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run…
• CVE-2018-11764 — CVSS 8.8 (high): Web endpoint authentication check is broken in Apache Hadoop 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0. Authenticated users may impersonate any…
• CVE-2017-3166 — CVSS 7.8 (high): In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, if a file in an encryption zone with access permissions that…
• CVE-2018-11765 — CVSS 7.5 (high): In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication…
• CVE-2012-2945 — CVSS 7.5 (high): Hadoop 1.0.3 contains a symlink vulnerability.
• CVE-2018-11768 — CVSS 7.5 (high): In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be…
• CVE-2018-1296 — CVSS 7.5 (high): In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, HDFS exposes extended attribute key/value pairs during…
• CVE-2018-11767 — CVSS 7.4 (high): In Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6, KMS blocking users or granting access to users incorrectly, if the system…
• CVE-2017-15713 — CVSS 6.5 (medium): Vulnerability in Apache Hadoop 0.23.x, 2.x before 2.7.5, 2.8.x before 2.8.3, and 3.0.0-alpha through 3.0.0-beta1 allows a cluster user to…
• CVE-2012-1574 — CVSS 6.5 (medium): The Kerberos/MapReduce security functionality in Apache Hadoop 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before 1.0.2…