Not rated
CVE-2018-11768 In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group…
Description
In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be corrupted across storing in fsimage and reading back from fsimage.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Hadoop | Versions not published |
References
- lists.apache.org lists.apache.org
- [hadoop-general] 20191004 Re:CVE-2018-11768: HDFS FSImage Corruption lists.apache.org
- [hadoop-hdfs-dev] 20191004 Re:CVE-2018-11768: HDFS FSImage Corruption lists.apache.org
- [hadoop-hdfs-dev] 20191004 Re: CVE-2018-11768: HDFS FSImage Corruption lists.apache.org
- [hadoop-hdfs-dev] 20191006 Re: CVE-2018-11768: HDFS FSImage Corruption lists.apache.org
- [lucene-dev] 20191029 Re: CVE-2018-11768 in regards to Solr lists.apache.org
- [lucene-dev] 20191029 CVE-2018-11768 in regards to Solr lists.apache.org
- [lucene-dev] 20191031 RE: CVE-2018-11768 in regards to Solr lists.apache.org
- [flink-dev] 20200806 Dependency vulnerabilities with Apache Flink 1.10.1 version lists.apache.org
- [flink-user] 20200806 Dependency vulnerabilities with Apache Flink 1.10.1 version lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache Hadoop
The 7 CVEs of Apache Hadoop →
CVE-2020-9492
In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO…
Not rated
CVE-2018-11764
Web endpoint authentication check is broken in Apache Hadoop 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0
Not rated
CVE-2018-11765
In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets…
Not rated
CVE-2018-8029
In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn…
Not rated