CVE-2022-25168

Apache Hadoop's FileUtil.unTarFile, File API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It has been used in...

CVE-2021-33036

A flaw was found in Hadoop Yarn. This flaw allows an attacker to benefit from permissions, escalate to a yarn user and run arbitrary commands as root...

MAL-2022-7326 Malicious code in yarn-design-system-flatpickr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 80e22d02d45401b2b71653d608457de445ef396c8f69cded06ca410f90d381a4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in yarn-design-system-react-select (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f71484235bb938827b22ed947508c7d827b1c3a707c1268e63845de0c538e354 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in yarn-design-system-choicesjs-stencil (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c5dcc28be538a581cdac4d85003da4d80c8186564837c3d86f64ffae81cda6e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7325 Malicious code in yarn-design-system-choicesjs-stencil (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c5dcc28be538a581cdac4d85003da4d80c8186564837c3d86f64ffae81cda6e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in yarn-design-system-fonts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 36271b16949d7666fab1ad7ffc09c9fc82404a3383c2421567ead9f1b025a988 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7329 Malicious code in yarn-design-system-rc-input-number (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware af670dcb9945b741b8a4b4a71a54c4da8d08032685b0db16fdfbe7847bd66d0c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in yarn-design-system-rc-tooltip (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 843c6a1e32f309a04455bd199d97770cd7c13f9fc26ab137fe28dd519efd3e9e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7327 Malicious code in yarn-design-system-fonts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 36271b16949d7666fab1ad7ffc09c9fc82404a3383c2421567ead9f1b025a988 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in yarn-design-system-rc-input-number (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware af670dcb9945b741b8a4b4a71a54c4da8d08032685b0db16fdfbe7847bd66d0c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Apache Hadoop Elevation of Privilege Vulnerability (CNVD-2022-51055)

Apache Hadoop is an open source distributed systems infrastructure from the Apache Foundation. The product is capable of distributed processing of large amounts of data and is highly reliable, scalable, and fault-tolerant. an elevation of privilege vulnerability exists in Apache Hadoop, which ste...

ch.cern.hadoop:hadoop-archive-logs (=3.2.1), ch.cern.hadoop:hadoop-datajoin (=3.2.1) +250 more potentially affected by CVE-2021-33036 via org.apache.hadoop:hadoop-yarn-server-common (>=3.0.0 <=3.2.2)

org.apache.hadoop:hadoop-yarn-server-common MAVEN version =3.0.0, =3.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hadoop:hadoop-yarn-server-common and may be impacted: - ch.cern.hadoop:hadoop-archive-logs =3.2.1 -...

GHSA-58JX-F5RF-QGQF User account escalation in Apache Hadoop

In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher...

ai.starlake:starlake-spark2_2.11 (>=0.2.7 <=0.2.8), ai.starlake:starlake-spark3_2.12 (>=0.2.7 <=0.2.10) +83 more potentially affected by CVE-2021-33036 via org.apache.hadoop:hadoop-yarn-server-common (>=3.3.0 <=3.3.1)

org.apache.hadoop:hadoop-yarn-server-common MAVEN version =3.3.0, =0.2.7, =0.2.7, =0.1.30, =0.1.30, =0.1.28, =0.9.0, =2.8.2, =2.8.2, =304, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =3.3.1 and more Source cves: CVE-2021-33036 Source advisory: OSV:GHSA-58JX-F5RF-QGQF...

CVE-2021-33036

In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher...

MAL-2022-7328 Malicious code in yarn-design-system-logos (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9006849a713475d0be0ef3619338ecd191969c2f0a3d9d8d310cd68e292e75a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in yarn-design-system-logos (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9006849a713475d0be0ef3619338ecd191969c2f0a3d9d8d310cd68e292e75a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-JPMF-8CJ2-595G Improper Link Resolution Before File Access in Apache Hadoop

The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote cluster users to change the permissions of certain files to world-readable via a symlink attack in a public tar archive, which is not properly handled during...

Improper Link Resolution Before File Access in Apache Hadoop

The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote cluster users to change the permissions of certain files to world-readable via a symlink attack in a public tar archive, which is not properly handled during...