What is GHSA-jpmf-8cj2-595g?

GHSA-jpmf-8cj2-595g is a security advisory published by GitHub Security Advisories with Medium severity. Improper Link Resolution Before File Access in Apache Hadoop

Which CVE IDs does GHSA-jpmf-8cj2-595g cover?

GHSA-jpmf-8cj2-595g covers the following CVE IDs: CVE-2014-3627. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-jpmf-8cj2-595g?

GHSA-jpmf-8cj2-595g affects 2 products, including: maven/org.apache.hadoop:hadoop-client:\u003e= 0.23.0, \u003c 1.0.1; maven/org.apache.hadoop:hadoop-client:\u003e= 2.0.0, \u003c 2.5.2.

GHSA-jpmf-8cj2-595gMedium

Improper Link Resolution Before File Access in Apache Hadoop

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2014-3627 →

📋 Description

The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote cluster users to change the permissions of certain files to world-readable via a symlink attack in a public tar archive, which is not properly handled during localization, related to distributed cache.

🎯 Affected products2

maven/org.apache.hadoop:hadoop-client:>= 0.23.0, < 1.0.1
maven/org.apache.hadoop:hadoop-client:>= 2.0.0, < 2.5.2

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2014-3627
http://mail-archives.apache.org/mod_mbox/hadoop-general/201411.mbox/%3CCALwhT97dOi04aC3VbekaB+zn2UAS_OZV2EAiP78GmjnMzfp2Ug@mail.gmail.com%3E
https://github.com/advisories/GHSA-jpmf-8cj2-595g