What is GHSA-9r7g-325h-mxrm?

GHSA-9r7g-325h-mxrm is a security advisory published by GitHub Security Advisories with Medium severity. Improper Authentication in Apache Hadoop

Which CVE IDs does GHSA-9r7g-325h-mxrm cover?

GHSA-9r7g-325h-mxrm covers the following CVE IDs: CVE-2014-0229. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9r7g-325h-mxrm?

GHSA-9r7g-325h-mxrm has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-9r7g-325h-mxrm?

GHSA-9r7g-325h-mxrm affects 2 products, including: maven/org.apache.hadoop:hadoop-common:\u003e= 0.23.0, \u003c 0.23.11; maven/org.apache.hadoop:hadoop-common:\u003e= 2.0.0, \u003c 2.4.1.

GHSA-9r7g-325h-mxrmMediumCVSS 6.5

Improper Authentication in Apache Hadoop

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2014-0229 →

📋 Description

Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1, as used in Cloudera CDH 5.0.x before 5.0.2, do not check authorization for the (1) refreshNamenodes, (2) deleteBlockPool, and (3) shutdownDatanode HDFS admin commands, which allows remote authenticated users to cause a denial of service (DataNodes shutdown) or perform unnecessary operations by issuing a command.

🎯 Affected products2

maven/org.apache.hadoop:hadoop-common:>= 0.23.0, < 0.23.11
maven/org.apache.hadoop:hadoop-common:>= 2.0.0, < 2.4.1

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2014-0229
https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html#concept_i1q_xvk_2r
https://github.com/advisories/GHSA-9r7g-325h-mxrm