Not rated
CVE-2018-8029 In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn…
Description
In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Hadoop | Versions not published |
References
- lists.apache.org lists.apache.org
- [hbase-issues] 20190530 [jira] [Commented] (HBASE-22499) Drop the support for several hadoop releases due to CVE-2018-8029 lists.apache.org
- 108518 www.securityfocus.com
- [hbase-dev] 20190603 [jira] [Resolved] (HBASE-22499) Drop the support for several hadoop releases due to CVE-2018-8029 lists.apache.org
- [hbase-issues] 20190603 [jira] [Resolved] (HBASE-22499) Drop the support for several hadoop releases due to CVE-2018-8029 lists.apache.org
- security.netapp.com security.netapp.com
- [druid-commits] 20201008 [druid] branch master updated: Suppress CVE-2018-11765 for hadoop dependencies (#10485) lists.apache.org
- [druid-commits] 20201008 [druid] branch 0.20.0 updated: Suppress CVE-2018-11765 for hadoop dependencies (#10485) (#10492) lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache Hadoop
The 7 CVEs of Apache Hadoop →
CVE-2020-9492
In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO…
Not rated
CVE-2018-11764
Web endpoint authentication check is broken in Apache Hadoop 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0
Not rated
CVE-2018-11765
In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets…
Not rated
CVE-2018-11768
In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group…
Not rated