There are multiple vulnerabilities in hadoop-mapreduce-client-core-2.7.3.jar used by IBM Application Performance Management. IBM Applicatoon Performance Management has addressed the applicable CVEs.
CVEID:CVE-2017-3166
**DESCRIPTION:**Apache Hadoop could allow a remote authenticated attacker to gain elevated privileges on the system, caused by a flaw in the YARN’s localization mechanism. By changing access permission to world readable in an encryption zone, an attacker could exploit this vulnerability to gain access to files protected by HDFS transparent encryption.
CVSS Base score: 8.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/134627 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected Product(s) | Version(s) |
---|---|
IBM Cloud APM, Base Private | 8.1.4 |
IBM Cloud APM, Advanced Private | 8.1.4 |
IBM Cloud Application Performance Management, Base Private
IBM Cloud Application Performance Management, Advanced Private| 8.1.4|
The vulnerability can be remediated by applying the following 8.1.4.0-IBM-APM-SERVER-IF0014 or later server patch to the system where the Cloud APM server is installed: <https://www.ibm.com/support/pages/node/7028410>
—|—|—
None
CPE | Name | Operator | Version |
---|---|---|---|
ibm application performance management | eq | 81.3 | |
ibm application performance management | eq | 8.1.4 |