Arbitrary File Write

spark-core is vulnerable to arbitrary file write. Lack of explicit checking of existence of source file in Utils.unpack before calling the method FileUtil.unTar of Hadoop which has a loophole in handling of missing .tar files...

OS Command Injection

hadoop-common is vulnerable to OS Command Injection. The vulnerability exists due to lack of sanitization of input file name by FileUtil.unTarFile, File API before being passed to the shell, allowing an attacker to pass malicious file name and inject arbitrary commands...

Apache Hadoop Parameter Injection Vulnerability

Apache Hadoop is an open source distributed system infrastructure from the Apache Foundation. The product is capable of distributed processing of large amounts of data and is highly reliable, scalable, and fault-tolerant. Apache Hadoop has a security vulnerability that stems from its...

CVE-2022-25168

Apache Hadoop's FileUtil.unTarFile, File API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It has been used in...

CVE-2022-25168

Apache Hadoop's FileUtil.unTarFile, File API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It has been used in...

CVE-2022-25168

CVE-2022-25168 affects Apache Hadoop's FileUtil.unTar(File, File) API, which does not escape the input file name before passing it to the shell. This enables command injection. In Hadoop, this vulnerability has been identified in the InMemoryAliasMap.bootstrap transfer path (local user context), ...

CVE-2022-25168 Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTar

Apache Hadoop's FileUtil.unTarFile, File API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It has been used in...