CVE-2015-4078

Cloudera Navigator 2.2.x before 2.2.4 and 2.3.x before 2.3.3 include support for SSLv3 when configured to use SSL/TLS, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 aka POODLE...

Design/Logic Flaw

Cloudera Key Trustee Server before 5.4.3 does not store keys synchronously, which might allow attackers to have unspecified impact via vectors related to loss of an encryption key...

Code injection

Cloudera Navigator 2.2.x before 2.2.4 and 2.3.x before 2.3.3 include support for SSLv3 when configured to use SSL/TLS, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 aka POODLE...

CVE-2013-6446

The JobHistory Server in Cloudera CDH 4.x before 4.6.0 and 5.x before 5.0.0 Beta 2, when using MRv2/YARN with HTTP authentication, allows remote authenticated users to obtain sensitive job information by leveraging failure to enforce job ACLs...

CVE-2015-2263

Cloudera Manager 4.x, 5.0.x before 5.0.6, 5.1.x before 5.1.5, 5.2.x before 5.2.5, and 5.3.x before 5.3.3 uses global read permissions for files in its configuration directory when starting YARN NodeManager, which allows local users to obtain sensitive information by reading the files, as...

CVE-2015-4078

Cloudera Navigator 2.2.x before 2.2.4 and 2.3.x before 2.3.3 include support for SSLv3 when configured to use SSL/TLS, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 aka POODLE...

CVE-2013-6446

The CVE concerns the JobHistory Server in Cloudera CDH 4.x prior to 4.6.0 and CDH 5.x prior to 5.0.0 Beta 2. When MRv2/YARN is used with HTTP authentication, remote authenticated users can obtain sensitive job information due to failure to enforce job ACLs. The description does not specify affect...

CVE-2014-0229

Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1 (and Cloudera CDH 5.0.x before 5.0.2) fail to check authorization for HDFS admin commands refreshNamenodes, deleteBlockPool, and shutdownDatanode. This allows remote authenticated users to cause DataNodes to shut down or perform unnecessary...

CVE-2015-2263

CVE-2015-2263 affects Cloudera Manager 4.x and 5.x releases (before 5.0.6, 5.1.5, 5.2.5, and 5.3.3 respectively). The root cause is that, during YARN NodeManager startup, the product grants global read permissions to files in its configuration directory. This enables local users to read sensitive...

CVE-2015-4078

CVE-2015-4078 maps to the POODLE-like issue where SSLv3 is supported by Cloudera Navigator 2.2.x (pre-2.2.4) and 2.3.x (pre-2.3.3), enabling a padding-oracle attack to obtain plaintext data. Public references in the connected docs describe SSLv3/POODLE vulnerability details and remediation patter...

CVE-2014-0229

Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1, as used in Cloudera CDH 5.0.x before 5.0.2, do not check authorization for the 1 refreshNamenodes, 2 deleteBlockPool, and 3 shutdownDatanode HDFS admin commands, which allows remote authenticated users to cause a denial of service DataNode...

CVE-2015-4166

Cloudera Key Trustee Server before 5.4.3 does not store keys synchronously, which might allow attackers to have unspecified impact via vectors related to loss of an encryption key...

CVE-2015-4166

Cloudera Key Trustee Server prior to 5.4.3 is affected: it does not store keys synchronously, which could lead to loss of an encryption key with unspecified impact. Vulnerable component: Key Trustee Server (before 5.4.3). Root cause: non-synchronous key storage. Impact: confidentiality, integrity...

CVE-2015-2263: Undefined Security Weakness

Cloudera Manager 4.x, 5.0.x before 5.0.6, 5.1.x before 5.1.5, 5.2.x before 5.2.5, and 5.3.x before 5.3.3 uses global read permissions for files in its configuration directory when starting YARN NodeManager, which allows local users to obtain sensitive information by reading the files, as...

CVE-2014-0229: Undefined Security Weakness

Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1, as used in Cloudera CDH 5.0.x before 5.0.2, do not check authorization for the 1 refreshNamenodes, 2 deleteBlockPool, and 3 shutdownDatanode HDFS admin commands, which allows remote authenticated users to cause a denial of service DataNode...

PT-2017-6563

Name of the Vulnerable Software and Affected Versions Cloudera Manager versions 4.x through 5.3.x before 5.3.3 Cloudera Manager versions 5.0.x through 5.0.5 Cloudera Manager versions 5.1.x through 5.1.4 Cloudera Manager versions 5.2.x through 5.2.4 Description The issue allows local users to obta...

PT-2017-6734

Name of the Vulnerable Software and Affected Versions Cloudera Navigator versions 2.2.x through 2.2.3 Cloudera Navigator versions 2.3.x through 2.3.2 Description The issue makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of the POODLE...

PT-2017-6740

Name of the Vulnerable Software and Affected Versions Cloudera Key Trustee Server versions prior to 5.4.3 Description The issue is related to the storage of keys, where keys are not stored synchronously, potentially allowing attackers to have an unspecified impact via vectors related to loss of a...

PT-2017-5593

Name of the Vulnerable Software and Affected Versions: Cloudera CDH versions 4.x through 4.5.x Cloudera CDH versions 5.x through 5.0.0 Beta 1 Description: The issue allows remote authenticated users to obtain sensitive job information by leveraging the failure to enforce job ACLs when using...

PT-2017-5781

Name of the Vulnerable Software and Affected Versions: Apache Hadoop versions 0.23.x through 0.23.10 Apache Hadoop versions 2.x through 2.4.0 Cloudera CDH versions 5.0.x through 5.0.1 Description: The issue allows remote authenticated users to cause a denial of service or perform unnecessary...