GHSA-mq8p-h798-xcrp

ghsaUSosv

Exposure of Sensitive Information in Hadoop

view advisory published 2018-12-21Licence: CC-BY-4.0

The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2017-15718US	critical9.8	3.57% (89th)	—	2018-01-24
The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications.

references

External citations — patches, advisories, analysis.

https://github.com/advisories/GHSA-mq8p-h798-xcrpADVISORY
https://lists.apache.org/thread.html/773c93c2d8a6a52bbe97610c2b1c2ad205b970e1b8c04fb5b2fccad6@%3Cgeneral.hadoop.apache.org%3EWEB
https://nvd.nist.gov/vuln/detail/CVE-2017-15718ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan