What is GHSA-v569-g72v-q434?

GHSA-v569-g72v-q434 is a security advisory published by GitHub Security Advisories with High severity. Exposure of Sensitive Information to an Unauthorized Actor in Hadoop

Which CVE IDs does GHSA-v569-g72v-q434 cover?

GHSA-v569-g72v-q434 covers the following CVE IDs: CVE-2018-1296. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-v569-g72v-q434?

GHSA-v569-g72v-q434 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-v569-g72v-q434?

GHSA-v569-g72v-q434 affects 3 products, including: maven/org.apache.hadoop:hadoop-main:\u003c 2.7.6; maven/org.apache.hadoop:hadoop-main:\u003e= 2.8.0, \u003c 2.8.4; maven/org.apache.hadoop:hadoop-main:= 2.9.0.

GHSA-v569-g72v-q434HighCVSS 7.5

Exposure of Sensitive Information to an Unauthorized Actor in Hadoop

Vendor

GitHub Security Advisories

Published

February 12, 2019

Last Modified

January 9, 2023

🔗 CVE IDs covered (1)

CVE-2018-1296 →

📋 Description

In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, HDFS exposes extended attribute key/value pairs during listXAttrs, verifying only path-level search access to the directory rather than path-level read permission to the referent.

🎯 Affected products3

maven/org.apache.hadoop:hadoop-main:< 2.7.6
maven/org.apache.hadoop:hadoop-main:>= 2.8.0, < 2.8.4
maven/org.apache.hadoop:hadoop-main:= 2.9.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2018-1296
https://github.com/advisories/GHSA-v569-g72v-q434
https://lists.apache.org/thread.html/a5b15bc76fbdad2ee40761aacf954a13aeef67e305f86d483f267e8e@%3Cuser.hadoop.apache.org%3E
http://www.securityfocus.com/bid/106764