The vulnerability in the implementation of the unTar() function for the distributed development and execution platform of Apache Hadoop allows a hacker to write arbitrary files.

🗓️ 11 May 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

Hadoop unTar() vulnerability allows attacker to write arbitrary files due to poor restricted-path checks.

Reporter	Title	Published	Views	Family All 30
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs	25 Oct 202214:32	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Hadoop affect IBM watsonx.data	18 Sep 202419:59	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insight v1.6.7 contains fixes for multiple security vulnerabilities.	15 Dec 202209:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected but not classified as vulnerable to multiple vulnerabilities in Apache Hadoop	17 May 202321:55	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Hadoop affect IBM Operations Analytics - Log Analysis (CVE-2022-26612, CVE-2022-25168)	22 Nov 202212:16	–	ibm
ATTACKERKB	CVE-2022-26612	7 Apr 202219:15	–	attackerkb
Circl	CVE-2022-26612	22 Apr 202211:01	–	circl
CNNVD	Apache Hadoop 后置链接漏洞	7 Apr 202200:00	–	cnnvd
CNVD	Apache Hadoop path traversal vulnerability	11 Apr 202200:00	–	cnvd
CVE	CVE-2022-26612	7 Apr 202218:20	–	cve

Vulners

Node

apache hadoopRange<3.2.3

Source	Link
lists	www.lists.apache.org/thread/hslo7wzw2449gv1jyjk8g6ttd7935fyz
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-26612
github	www.github.com/apache/hadoop/blob/125e3b616040b4f98956aa946cc51e99f7d596c2/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileUtil.java
github	www.github.com/apache/hadoop/blob/125e3b616040b4f98956aa946cc51e99f7d596c2/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileUtil.java
github	www.github.com/apache/hadoop/blob/125e3b616040b4f98956aa946cc51e99f7d596c2/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileUtil.java
vuldb	www.vuldb.com/ru/
web	www.web.nvd.nist.gov/view/vuln/detail

11 May 2022 00:00Current

8High risk

Vulners AI Score8

CVSS 39.8

CVSS 210

EPSS0.0022

hadoop platform untar vulnerability restricted path checks arbitrary file write