GHSA-h24p-qwf4-84q8HighCVSS 7.5

Apache Hadoop's LinuxContainerExecutor runs docker commands as root with insufficient input validation

Published
May 17, 2022
Last Modified
February 2, 2023

🔗 CVE IDs covered (1)

CVE-2017-7669 →

📋 Description

In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root. This issue is fixed in versions 2.8.1 and 3.0.0-alpha3.

🎯 Affected products2

  • maven/org.apache.hadoop:hadoop-common:< 2.8.1
  • maven/org.apache.hadoop:hadoop-common:>= 3.0.0-alpha1, < 3.0.0-alpha3

🔗 References (4)