Not rated
CVE-2018-11765 In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets…
Description
In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication when Kerberos authentication is enabled and SPNEGO through HTTP is not enabled.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Hadoop | Versions not published |
References
- lists.apache.org lists.apache.org
- [druid-dev] 20201007 [CANCEL][VOTE] Release Apache Druid 0.20.0 [RC1] lists.apache.org
- [druid-commits] 20201007 [GitHub] [druid] jon-wei opened a new pull request #10485: Suppress CVE-2018-11765 for hadoop dependencies lists.apache.org
- [druid-commits] 20201008 [druid] branch master updated: Suppress CVE-2018-11765 for hadoop dependencies (#10485) lists.apache.org
- [druid-commits] 20201008 [GitHub] [druid] jon-wei merged pull request #10485: Suppress CVE-2018-11765 for hadoop dependencies lists.apache.org
- [druid-commits] 20201008 [GitHub] [druid] jon-wei opened a new pull request #10492: [Backport] Suppress CVE-2018-11765 for hadoop dependencies (#10485) lists.apache.org
- [druid-commits] 20201008 [druid] branch 0.20.0 updated: Suppress CVE-2018-11765 for hadoop dependencies (#10485) (#10492) lists.apache.org
- [druid-commits] 20201008 [GitHub] [druid] jon-wei merged pull request #10492: [Backport] Suppress CVE-2018-11765 for hadoop dependencies (#10485) lists.apache.org
- [druid-commits] 20201009 [GitHub] [druid] jon-wei merged pull request #10485: Suppress CVE-2018-11765 for hadoop dependencies lists.apache.org
- [druid-commits] 20201009 [GitHub] [druid] jon-wei opened a new pull request #10492: [Backport] Suppress CVE-2018-11765 for hadoop dependencies (#10485) lists.apache.org
- [druid-commits] 20201009 [GitHub] [druid] jon-wei merged pull request #10492: [Backport] Suppress CVE-2018-11765 for hadoop dependencies (#10485) lists.apache.org
- security.netapp.com security.netapp.com
Timeline
- Published
- Last modified
Other CVEs of Apache Hadoop
The 7 CVEs of Apache Hadoop →
CVE-2020-9492
In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO…
Not rated
CVE-2018-11764
Web endpoint authentication check is broken in Apache Hadoop 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0
Not rated
CVE-2018-11768
In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group…
Not rated
CVE-2018-8029
In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn…
Not rated