K12772312: Apache Hadoop vulnerability CVE-2017-7669

Security Advisory Description In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root. CVE-2017-7669 Impact There is no...

com.twitter.ambrose:ambrose-common (>=0.2.0, <=0.3.0), com.twitter.ambrose:ambrose-hive (>=0.2.6, <=0.3.0) +8 more potentially affected by CVE-2017-7669 via org.apache.hadoop:hadoop-common (0.22.0)

org.apache.hadoop:hadoop-common MAVEN version 0.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hadoop:hadoop-common and may be impacted: - com.twitter.ambrose:ambrose-common =0.2.0, =0.2.6, =0.2.0, =1.0.0, =1.0.5 -...

org.apache.hama:hama-yarn (>=0.5.0, <=0.6.2) potentially affected by CVE-2017-7669 via org.apache.hadoop:hadoop-common (0.23.1)

org.apache.hadoop:hadoop-common MAVEN version 0.23.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hadoop:hadoop-common and may be impacted: - org.apache.hama:hama-yarn =0.5.0, =0.6.2 Source cves: CVE-2017-7669 Source advisory:...

org.apache.hadoop:hadoop-client (0.23.9) potentially affected by CVE-2017-7669 via org.apache.hadoop:hadoop-common (0.23.9)

org.apache.hadoop:hadoop-common MAVEN version 0.23.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hadoop:hadoop-common and may be impacted: - org.apache.hadoop:hadoop-client 0.23.9 Source cves: CVE-2017-7669 Source advisory:...

ae.teletronics.nlp:entityextraction (1.3), ae.teletronics.nlp:w2vec (1.0) +4634 more potentially affected by CVE-2017-7669 via org.apache.hadoop:hadoop-common (>=2.0.4-alpha, <=2.8.0)

org.apache.hadoop:hadoop-common MAVEN version =2.0.4-alpha, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =local, =local, =0.42.1, =0.78.8 and more Source cves: CVE-2017-7669...

org.apache.hadoop:hadoop-client (0.23.7) potentially affected by CVE-2017-7669 via org.apache.hadoop:hadoop-common (0.23.7)

org.apache.hadoop:hadoop-common MAVEN version 0.23.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hadoop:hadoop-common and may be impacted: - org.apache.hadoop:hadoop-client 0.23.7 Source cves: CVE-2017-7669 Source advisory:...

org.apache.hadoop:hadoop-client (0.23.10), org.securegraph:securegraph-accumulo (>=0.5.0, <=0.8.1) +5 more potentially affected by CVE-2017-7669 via org.apache.hadoop:hadoop-common (0.23.10)

org.apache.hadoop:hadoop-common MAVEN version 0.23.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hadoop:hadoop-common and may be impacted: - org.apache.hadoop:hadoop-client 0.23.10 - org.securegraph:securegraph-accumulo =0.5.0, =0.5.0,...

org.apache.hadoop.contrib:hadoop-hdfs-bkjournal (3.0.0-alpha1), org.apache.hadoop:hadoop-aliyun (3.0.0-alpha2) +54 more potentially affected by CVE-2017-7669 via org.apache.hadoop:hadoop-common (>=3.0.0-alpha1, <=3.0.0-alpha2)

org.apache.hadoop:hadoop-common MAVEN version =3.0.0-alpha1, =3.0.0-alpha1, =3.0.0-alpha1, =3.0.0-alpha1, =3.0.0-alpha1, =3.0.0-alpha1, =3.0.0-alpha1, =3.0.0-alpha1, =3.0.0-alpha1, =3.0.0-alpha1, =3.0.0-alpha1, =3.0.0-alpha1, =3.0.0-alpha2 and more Source cves: CVE-2017-7669 Source advisory:...

org.apache.hadoop.contrib:hadoop-hdfs-bkjournal (3.0.0-alpha1), org.apache.hadoop:hadoop-aliyun (3.0.0-alpha2) +54 more potentially affected by CVE-2017-7669 via org.apache.hadoop:hadoop-common (>=3.0.0-alpha1, <=3.0.0-alpha2)

org.apache.hadoop:hadoop-common MAVEN version =3.0.0-alpha1, =3.0.0-alpha1, =3.0.0-alpha1, =3.0.0-alpha1, =3.0.0-alpha1, =3.0.0-alpha1, =3.0.0-alpha1, =3.0.0-alpha1, =3.0.0-alpha1, =3.0.0-alpha1, =3.0.0-alpha1, =3.0.0-alpha1, =3.0.0-alpha2 and more Source cves: CVE-2017-7669 Source advisory:...

ae.teletronics.nlp:entityextraction (1.3), ae.teletronics.nlp:w2vec (1.0) +4634 more potentially affected by CVE-2017-7669 via org.apache.hadoop:hadoop-common (>=2.0.4-alpha, <=2.8.0)

org.apache.hadoop:hadoop-common MAVEN version =2.0.4-alpha, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =local, =local, =0.42.1, =0.78.8 and more Source cves: CVE-2017-7669...

CVE-2017-7669

In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root...

CVE-2017-7669

CVE-2017-7669 affects Apache Hadoop where the LinuxContainerExecutor runs docker commands as root when the docker feature is enabled, due to insufficient input validation. Affected versions include Hadoop 2.8.0 and 3.0.0-alpha1/alpha2; authenticated users could execute commands as root. The issue...

ae.teletronics.nlp:entityextraction (1.3), ae.teletronics.nlp:w2vec (1.0) +4646 more potentially affected by CVE-2017-7669 via org.apache.hadoop:hadoop-common (>=0.22.0, <=2.8.0)

org.apache.hadoop:hadoop-common MAVEN version =0.22.0, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =local, =local, =0.42.1, =0.78.8 and more Source cves: CVE-2017-7669 Source...