GHSA-895m-ww55-59vw

ghsaUSosv

Exposure of Sensitive Information to an Unauthorized Actor in Apache Hadoop

view advisory published 2022-05-17Licence: CC-BY-4.0

The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for credential store provider used by the NodeManager to YARN Applications.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2016-3086US	critical9.8	3.65% (90th)	—	2017-09-05
The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for credential store provider used by the NodeManager to YARN Applications.

references

External citations — patches, advisories, analysis.

http://mail-archives.apache.org/mod_mbox/hadoop-general/201701.mbox/%3C0ed32746-5a53-9051-5877-2b1abd88beb6%40apache.org%3EWEB
http://www.securityfocus.com/bid/95335WEB
https://nvd.nist.gov/vuln/detail/CVE-2016-3086ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan