GHSA-rmpj-7c96-mrg8

ghsaUSosv

Apache Hadoop heap overflow before v2.10.2, v3.2.3, v3.3.2

view advisory published 2022-06-14Licence: CC-BY-4.0

There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may result in a denial of service or arbitrary code execution. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-37404US	critical9.8	2.99% (87th)	—	2022-06-13
There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may result in a denial of service or arbitra…

references

External citations — patches, advisories, analysis.

https://github.com/apache/hadoopPACKAGE
https://lists.apache.org/thread/2h56ztcj3ojc66qzf1nno88vjw9vd4woWEB
https://nvd.nist.gov/vuln/detail/CVE-2021-37404ADVISORY
https://security.netapp.com/advisory/ntap-20220715-0007WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan