Description
In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Apache Hadoop | Apache Hadoop 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, 2.2.0 to 2.8.4 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.hadoop:hadoop-main | >= 2.2.0, < 2.8.4 | 2.8.4 | GHSA-37pw-qw47-4jxm |
| Maven | org.apache.hadoop:hadoop-main | >= 2.9.0, < 2.9.2 | 2.9.2 | GHSA-37pw-qw47-4jxm |
| Maven | org.apache.hadoop:hadoop-main | >= 3.0.0, < 3.1.1 | 3.1.1 | GHSA-37pw-qw47-4jxm |
Advisories 1
- WID-SEC-2025-0227 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
References
- https://lists.apache.org/thread.html/17084c09e6dedf60efe08028b429c92ffd28aacc28454e4fa924578a%40%3Cgeneral.hadoop.apache.org%3E
- [hbase-issues] 20190530 [jira] [Commented] (HBASE-22499) Drop the support for several hadoop releases due to CVE-2018-8029 mailing-list
- 108518 vdb-entry
- [hbase-dev] 20190603 [jira] [Resolved] (HBASE-22499) Drop the support for several hadoop releases due to CVE-2018-8029 mailing-list
- [hbase-issues] 20190603 [jira] [Resolved] (HBASE-22499) Drop the support for several hadoop releases due to CVE-2018-8029 mailing-list
- https://security.netapp.com/advisory/ntap-20190617-0001/
- [druid-commits] 20201008 [druid] branch master updated: Suppress CVE-2018-11765 for hadoop dependencies (#10485) mailing-list
- [druid-commits] 20201008 [druid] branch 0.20.0 updated: Suppress CVE-2018-11765 for hadoop dependencies (#10485) (#10492) mailing-list