Apache Hadoop privilege escalation | CVE-2021-33036
NAME
Apache Hadoop privilege escalation
- Platforms Affected:
Apache Hadoop 3.0.0-alpha
Apache Hadoop 2.2.0
Apache Hadoop 3.2.0
Apache Hadoop 2.10.1
Apache Hadoop 3.1.4
Apache Hadoop 3.2.2
Apache Hadoop 3.3.0
Apache Hadoop 3.3.1 - Risk Level:
8.8 - Exploitability:
Unproven - Consequences:
Gain Privileges
DESCRIPTION
Apache Hadoop could allow a remote authenticated attacker to gain elevated privileges on the system, caused by improper permission assignment. By sending a specially-crafted request, an authenticated attacker could exploit this vulnerability execute arbitrary commands with root privileges.
CVSS 3.0 Information
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Access Vector: Network
- Access Complexity: Low
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
- Remediation Level: Official Fix
MITIGATION
Upgrade to the latest version of Apache Hadoop (2.10.2, 3.2.3, 3.3.2 or later), available from the Apache Web site. See References.
- Reference Link:
https://seclists.org/oss-sec/2022/q2/199 - Reference Link:
https://hadoop.apache.org/
If you like the site, please consider joining the telegram channel and supporting us on Patreon using the button below.
