GHSA-h24p-qwf4-84q8

ghsaUSosv

Apache Hadoop's LinuxContainerExecutor runs docker commands as root with insufficient input validation

view advisory published 2022-05-17Licence: CC-BY-4.0

In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root. This issue is fixed in versions 2.8.1 and 3.0.0-alpha3.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2017-7669US	high7.5	1.80% (78th)	—	2017-06-05
In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabl…

references

External citations — patches, advisories, analysis.

http://www.securityfocus.com/bid/98795WEB
https://mail-archives.apache.org/mod_mbox/hadoop-user/201706.mbox/%3C4A2FDA56-491B-4C2A-915F-C9D4A4BDB92A%40apache.org%3EWEB
https://nvd.nist.gov/vuln/detail/CVE-2017-7669ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan