Description
In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication when Kerberos authentication is enabled and SPNEGO through HTTP is not enabled.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Apache Hadoop | Apache Hadoop 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.hadoop:hadoop-main | >= 3.0.0-alpha2, < 3.0.1 | 3.0.1 | GHSA-rhh9-cm65-3w54 |
| Maven | org.apache.hadoop:hadoop-main | >= 2.9.0, < 2.9.3 | 2.9.3 | GHSA-rhh9-cm65-3w54 |
| Maven | org.apache.hadoop:hadoop-main | >= 2.8.0, < 2.8.6 | 2.8.6 | GHSA-rhh9-cm65-3w54 |
References
- https://lists.apache.org/thread.html/r2c7f899911a04164ed1707083fcd4135f8427e04778c87d83509b0da%40%3Cgeneral.hadoop.apache.org%3E
- [druid-dev] 20201007 [CANCEL][VOTE] Release Apache Druid 0.20.0 [RC1] mailing-list
- [druid-commits] 20201007 [GitHub] [druid] jon-wei opened a new pull request #10485: Suppress CVE-2018-11765 for hadoop dependencies mailing-list
- [druid-commits] 20201008 [druid] branch master updated: Suppress CVE-2018-11765 for hadoop dependencies (#10485) mailing-list
- [druid-commits] 20201008 [GitHub] [druid] jon-wei merged pull request #10485: Suppress CVE-2018-11765 for hadoop dependencies mailing-list
- [druid-commits] 20201008 [GitHub] [druid] jon-wei opened a new pull request #10492: [Backport] Suppress CVE-2018-11765 for hadoop dependencies (#10485) mailing-list
- [druid-commits] 20201008 [druid] branch 0.20.0 updated: Suppress CVE-2018-11765 for hadoop dependencies (#10485) (#10492) mailing-list
- [druid-commits] 20201008 [GitHub] [druid] jon-wei merged pull request #10492: [Backport] Suppress CVE-2018-11765 for hadoop dependencies (#10485) mailing-list
- [druid-commits] 20201009 [GitHub] [druid] jon-wei merged pull request #10485: Suppress CVE-2018-11765 for hadoop dependencies mailing-list
- [druid-commits] 20201009 [GitHub] [druid] jon-wei opened a new pull request #10492: [Backport] Suppress CVE-2018-11765 for hadoop dependencies (#10485) mailing-list
- [druid-commits] 20201009 [GitHub] [druid] jon-wei merged pull request #10492: [Backport] Suppress CVE-2018-11765 for hadoop dependencies (#10485) mailing-list
- https://security.netapp.com/advisory/ntap-20201016-0005/