CVE-2012-1574: Apache Hadoop allows impersonation of arbitrary cluster user accounts
Summary
CVE-2012-1574: Apache Hadoop allows impersonation of arbitrary cluster user accounts. Affects org.apache.hadoop:hadoop-main across 2 version ranges.
>= 0.23, < 0.23.2
>= 1.0, < 1.0.2
Fixed in 0.23.2 or 1.0.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Hadoop is an open-source framework used for distributed storage and processing of large datasets. It provides a scalable and reliable platform for big data analytics. The Kerberos/MapReduce security functionality in Apache Hadoop versions 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before 1.0.2 is vulnerable to an impersonation attack. This vulnerability allows remote authenticated users to impersonate arbitrary cluster user accounts, potentially leading to unauthorized access and misuse of resources.
Vulnerability Detail
The vulnerability in Apache Hadoop arises from a flaw in the Kerberos/MapReduce security functionality. Remote authenticated users can exploit this vulnerability to impersonate arbitrary cluster user accounts. The exact vectors of exploitation are unspecified. This vulnerability affects various versions of Apache Hadoop, including Cloudera CDH CDH3u0 through CDH3u2 and Cloudera hadoop-0.20-sbin before 0.20.2+923.197. The impact of this vulnerability can be significant, as it allows unauthorized access to sensitive data and resources within the Hadoop cluster.
How To Fix
Latest published version: 3.5.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 0.23, < 0.23.20.23.2 -
>= 1.0, < 1.0.21.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is recommended to apply the fix by upgrading to the patched versions of Apache Hadoop as mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability in Apache Hadoop allows remote authenticated users to impersonate arbitrary cluster user accounts, potentially leading to unauthorized access and misuse of resources. To mitigate this vulnerability, it is crucial to upgrade to the patched versions of Apache Hadoop as mentioned in the 'how_to_fix' section. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for org.apache.hadoop:hadoop-main →
FAQ
Apache Hadoop is an open-source framework for distributed storage and processing of large datasets. It provides a scalable and reliable platform for big data analytics.
This vulnerability allows remote authenticated users to impersonate arbitrary cluster user accounts in Apache Hadoop. It can lead to unauthorized access and misuse of resources within the Hadoop cluster.
The vulnerability affects Apache Hadoop versions 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before 1.0.2. It also impacts Cloudera CDH CDH3u0 through CDH3u2 and Cloudera hadoop-0.20-sbin before 0.20.2+923.197.
To fix this vulnerability, it is recommended to upgrade to a patched version of Apache Hadoop. Users should update to version 0.23.2 or later for 0.23.x releases, and version 1.0.2 or later for 1.0.x releases.
There is no specific workaround provided for this vulnerability. It is recommended to apply the fix by upgrading to the patched versions of Apache Hadoop.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.hadoop:hadoop-main.
