CVE-2017-3166 — Moderate severity vulnerability that affects org.apache.hadoop:hadoop-main

Description

In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, if a file in an encryption zone with access permissions that make it world readable is localized via YARN's localization mechanism, that file will be stored in a world-readable location and can be shared freely with any application that requests to localize that file.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Hadoop	2.6.1 to 2.6.5, 2.7.0 to 2.7.3, 3.0.0-alpha1 to 3.0.0-alpha3	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.apache.hadoop:hadoop-main	< 2.7.3	2.7.3	GHSA-99qr-9cc9-fv2x

References

[general] 20171108 [SECURITY] CVE-2017-3166: Apache Hadoop Privilege escalation vulnerability mailing-list
[druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities mailing-list