Description
The Kerberos/MapReduce security functionality in Apache Hadoop 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before 1.0.2, as used in Cloudera CDH CDH3u0 through CDH3u2, Cloudera hadoop-0.20-sbin before 0.20.2+923.197, and other products, allows remote authenticated users to impersonate arbitrary cluster user accounts via unspecified vectors.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.hadoop:hadoop-main | >= 0.23, < 0.23.2 | 0.23.2 | GHSA-c6f9-4pmv-m7m6 |
| Maven | org.apache.hadoop:hadoop-main | >= 1.0, < 1.0.2 | 1.0.2 | GHSA-c6f9-4pmv-m7m6 |
References
- 20120405 [CVE-2012-1574] Apache Hadoop user impersonation vulnerability mailing-list
- 48775 third-party-advisory
- https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html
- 20120405 [CVE-2012-1574] Apache Hadoop user impersonation vulnerability mailing-list
- 48776 third-party-advisory
- 52939 vdb-entry
- https://ccp.cloudera.com/display/DOC/Cloudera+Security+Bulletin