CVE-2012-3376: Client BlockTokens not checked in Apache Hadoop
Summary
CVE-2012-3376: Client BlockTokens not checked in Apache Hadoop. Affects org.apache.hadoop:hadoop-client versions >= 2.0.0-alpha, < 2.0.1-alpha. Fixed in 2.0.1-alpha. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Hadoop is an open-source framework used for distributed storage and processing of large datasets. The 'hadoop-client' package is a component of Apache Hadoop that provides client libraries and utilities for interacting with Hadoop clusters. This vulnerability affects versions 2.0.0-alpha to 2.0.1-alpha of the 'hadoop-client' package.
Vulnerability Detail
The vulnerability in Apache Hadoop 2.0.0 alpha allows remote clients to bypass BlockToken checks when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName. This can lead to several security issues, including unauthorized reading of arbitrary blocks, writing to blocks with only read access, and other unspecified impacts.
How To Fix
Minimum fixed version
2.0.1-alpha
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the fix by upgrading to a patched version of Apache Hadoop.
Conclusion
In conclusion, the 'hadoop-client' package in Apache Hadoop versions 2.0.0-alpha to 2.0.1-alpha is vulnerable to a security issue that allows remote clients to bypass BlockToken checks. Upgrading to version 2.0.1-alpha or later is recommended to address this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.hadoop:hadoop-client →
FAQ
Apache Hadoop is an open-source framework for distributed storage and processing of large datasets.
Versions 2.0.0-alpha to 2.0.1-alpha of the 'hadoop-client' package are affected.
The vulnerability allows remote clients to read arbitrary blocks, write to blocks with only read access, and potentially have other unspecified impacts.
No, there is no known workaround. It is necessary to upgrade to a patched version of Apache Hadoop.
To fix this vulnerability, upgrade to version 2.0.1-alpha or later of the 'hadoop-client' package.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.hadoop:hadoop-client.
