High · 7.3 CVE-2017-3162 EUVD-2022-4816GHSA-pr9x-qmp5-j3rr

Improper Input Validation in Apache Hadoop

Published Apr 26, 2017 · Updated Aug 5, 2024 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Hadoop Package: org.apache.hadoop:hadoop-client Ecosystem: Maven

Description

HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace. The NameNode is provided as a query parameter that is not validated in Apache Hadoop before 2.7.0.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Hadoop	2.6.x and earlier	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.apache.hadoop:hadoop-client	< 2.7.0	2.7.0	GHSA-pr9x-qmp5-j3rr

Advisories 1

WID-SEC-2026-2751 IBM InfoSphere Guardium: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026

References

98017 vdb-entry
[hadoop-common-dev] 20170425 CVE-2017-3162: Apache Hadoop DataNode web UI vulnerability mailing-list
[hadoop-user] 20200604 Re: CVE-2017-3161 & CVE-2017-3162 | WhiteSource mailing-list
[flink-user] 20210703 Re: owasp-dependency-check is flagging flink 1.13 for scala 2.12.7 mailing-list