Exposure of Sensitive Information in Hadoop

The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications...

Moderate severity vulnerability that affects org.apache.hadoop:hadoop-main

In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, if a file in an encryption zone with access permissions that make it world readable is localized via YARN's localization mechanism, that file will be stored in a world-readable location and can be shared freely with any...

GHSA-99QR-9CC9-FV2X Moderate severity vulnerability that affects org.apache.hadoop:hadoop-main

In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, if a file in an encryption zone with access permissions that make it world readable is localized via YARN's localization mechanism, that file will be stored in a world-readable location and can be shared freely with any...

Privilege Escalation

hadoop-yarn-server-nodemanager is vulnerable to a privilege escalation. The library does not properly sanitize input from the LinuxContainerExecutor when running in a docker container, allowing authenticated user to run commands in the container as a root user...

Hadoop YARN ResourceManager Remote Command Execution

An unauthenticated command execution vulnerability exists in Apache Hadoop. A remote, unauthenticated attacker can leverage this vulnerability by sending a malicious request to the target server. A successful attack could lead to a remote command execution...

Apache Hadoop YARN ResourceManager Web Interface

The web interface for Hadoop YARN ResourceManager was detected on the remote host. This interface can be used to monitor and assign resources for application execution. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid117616; scriptversion"1.4";...

Apache Hadoop YARN ResourceManager Unauthenticated RCE (Remote) (Xbash)

The Apache Hadoop YARN ResourceManager running on the remote host is allowing unauthenticated users to create and execute applications. An unauthenticated, remote attacker can exploit this, via a specially crafted HTTP request, to potentially execute arbitrary code, subject to the user privileges...

Apache Hadoop YARN ResourceManager remote command execution

Added: 07/20/2018 Background Apache Hadoop is a framework that allows for the distributed processing of large data sets across clusters of computers. YARN Yet Another Resource Negotiator is the component of Apache Hadoop which manages resources. Problem A vulnerability in the REST API in the YARN...

Apache Hadoop YARN ResourceManager remote command execution

Added: 07/20/2018 Background Apache Hadoop is a framework that allows for the distributed processing of large data sets across clusters of computers. YARN Yet Another Resource Negotiator is the component of Apache Hadoop which manages resources. Problem A vulnerability in the REST API in the YARN...

Apache Hadoop YARN ResourceManager remote command execution

Added: 07/20/2018 Background Apache Hadoop is a framework that allows for the distributed processing of large data sets across clusters of computers. YARN Yet Another Resource Negotiator is the component of Apache Hadoop which manages resources. Problem A vulnerability in the REST API in the YARN...

Security Bulletin: Yarn UI/API Security issue

Summary The Yarn UI/API running on port 8088 is not secured by default. If the host machine or container is configured in a network where port 8088 is open to the internet then, in this mode of operation, anonymous users can submit yarn applications. A yarn application can perform arbitrary tasks...

Apache #Hadoop YARN ResourceManager Unauthenticated Command Execution Exploit

This Metasploit module exploits an unauthenticated command execution vulnerability in Apache Hadoop through ResourceManager REST API. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Hadoop YARN...

craftcruises.com XSS vulnerability

Open Bug Bounty ID: OBB-626679 Description| Value ---|--- Affected Website:| craftcruises.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

DAG Client Leakage

tez-api is vulnerable to DAG client Leakage. The vulnerability exists because when terminating the connection to the YARN cluster, it does not shutdown Prewarm DAG client, leading to the leakage of DAG client...

Apache Hadoop 2.7.3 Privilege Escalation Vulnerability

Exploit for multiple platform in category remote exploits CVE-2016-6811: Apache Hadoop Privilege escalation vulnerability Severity: Critical Vendor: The Apache Software Foundation Versions Affected: All the Apache Hadoop versions from 2.2.0 to 2.7.3 Description: A user who can escalate to yarn us...

Apache Hadoop elevation of privilege vulnerability (CNVD-2018-10426)

Apache Hadoop is the U.S. Apache Apache Software Foundation's set of open source distributed systems infrastructure, it can be distributed processing of large amounts of data, and has high reliability, high scalability, high fault tolerance and other characteristics. Apache Hadoop 2.2.0 to 2.7.3...

File Permission Manipulation Via Symlink Attack

hadoop-common-yarn is vulnerable to file permission manipulation. Using a symlink attack in a public tar archive, attackers can change the permissions on files to be world-readable...

Information Disclosure

hadoop-yarn-server-nodemanager is vulnerable to password leakage. The fix for CVE-2016-3086 was incomplete so passwords from the credential store provider are still leaked through the NodeManager...

Apache Hadoop YARN NodeManager Password Leak Vulnerability

In Apache Hadoop 2.7.3 and 2.7.4, the security fix for CVE-2016-3086 is incomplete. The YARN NodeManager can leak the password for credential store provider used by the NodeManager to YARN Applications. CVE-2017-15718: Apache Hadoop YARN NodeManager vulnerability Severity: Important Vendor: The...

Apache Hadoop 2.7.3 - 2.7.4 YARN NodeManager Information Disclosure Vulnerability

Apache Hadoop is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:hadoop"...