Description
In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Hadoop | 2.8.0, 3.0.0-alpha1 and 3.0.0-alpha2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.hadoop:hadoop-common | < 2.8.1 | 2.8.1 | GHSA-h24p-qwf4-84q8 |
| Maven | org.apache.hadoop:hadoop-common | >= 3.0.0-alpha1, < 3.0.0-alpha3 | 3.0.0-alpha3 | GHSA-h24p-qwf4-84q8 |
References
- 98795 vdb-entry
- [hadoop-user] 20170602 CVE-2017-7669: Apache Hadoop privilege escalation mailing-list