CVE-2022-25168

🗓️ 04 Aug 2022 14:30:17Reported by apacheType

cve🔗 web.nvd.nist.gov📰️ 6 Media mentions👁 768 Views

Apache Hadoop's FileUtil.unTar(File, File) API allows arbitrary command injection via unescaped input file name before passing to shell. Upgrade to Hadoop 2.10.2, 3.2.4, 3.3.3 or upper (including HADOOP-18136) to prevent remote code execution

Reporter	Title	Published	Views	Family All 28
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM includes multiple components with known vulnerabilities	13 Feb 202313:10	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Hadoop affect IBM watsonx.data	18 Sep 202419:59	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insight v1.6.7 contains fixes for multiple security vulnerabilities.	15 Dec 202209:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected but not classified as vulnerable to multiple vulnerabilities in Apache Hadoop	17 May 202321:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar User Behavior Analytics is vulnerable to components with known vulnerabilities	7 Jun 202310:53	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Hadoop affect IBM Operations Analytics - Log Analysis (CVE-2022-26612, CVE-2022-25168)	22 Nov 202212:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Spectrum Scale (GPFS) Hadoop connector is affected by a security vulnerability (CVE-2022-25168)	5 Dec 202210:30	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs	15 Dec 202203:09	–	ibm
ATTACKERKB	CVE-2022-25168	4 Aug 202215:15	–	attackerkb
Circl	CVE-2022-25168	4 Aug 202218:19	–	circl

NVD

Vulners

Node

apache hadoopRange2.0.0–2.10.1

apache hadoopRange3.0.0–3.2.3

apache hadoopRange3.3.0–3.3.2

[
  {
    "product": "Apache Hadoop",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "2.0.0 to 2.10.1"
      },
      {
        "status": "affected",
        "version": "3.0.0-alpha to 3.2.3"
      },
      {
        "status": "affected",
        "version": "3.3.0 to 3.3.2"
      }
    ]
  }
]