Description
In Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6, KMS blocking users or granting access to users incorrectly, if the system uses non-default groups mapping mechanisms.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Apache Hadoop | Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.hadoop:hadoop-main | >= 2.7.5, < 2.7.7 | 2.7.7 | GHSA-5cf4-jqwp-584g |
| Maven | org.apache.hadoop:hadoop-main | >= 2.8.3, < 2.8.5 | 2.8.5 | GHSA-5cf4-jqwp-584g |
| Maven | org.apache.hadoop:hadoop-main | >= 2.9.0, < 2.9.2 | 2.9.2 | GHSA-5cf4-jqwp-584g |
References
- [hadoop-general] 20190311 CVE-2018-11767: Apache Hadoop KMS ACL regression mailing-list
- [hadoop-common-issues] 20190318 [jira] [Created] (HADOOP-16200) Add regression test for CVE-2018-11767 mailing-list
- [hadoop-common-dev] 20190318 [jira] [Created] (HADOOP-16200) Add regression test for CVE-2018-11767 mailing-list
- https://security.netapp.com/advisory/ntap-20190416-0009/
- [druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities mailing-list