GHSA-rhh9-cm65-3w54HighCVSS 7.5

Improper Authentication in Apache Hadoop

Published
April 30, 2021
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2018-11765 →

📋 Description

In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication when Kerberos authentication is enabled and SPNEGO through HTTP is not enabled.

🎯 Affected products3

  • maven/org.apache.hadoop:hadoop-main:>= 3.0.0-alpha2, <= 3.0.0
  • maven/org.apache.hadoop:hadoop-main:>= 2.9.0, <= 2.9.2
  • maven/org.apache.hadoop:hadoop-main:>= 2.8.0, <= 2.8.5

🔗 References (14)