CVE-2014-0229: Improper Authentication in Apache Hadoop
Summary
CVE-2014-0229: Improper Authentication in Apache Hadoop. Affects org.apache.hadoop:hadoop-common across 2 version ranges.
>= 0.23.0, < 0.23.11
>= 2.0.0, < 2.4.1
Fixed in 0.23.11 or 2.4.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Hadoop is an open-source framework used for distributed storage and processing of large datasets. It provides a scalable and reliable platform for big data analytics. The vulnerable package, org.apache.hadoop:hadoop-common, is a core component of Apache Hadoop that includes common utilities and libraries used by other Hadoop modules. This package is widely used in various Hadoop distributions, including Cloudera CDH 5.0.x.
Vulnerability Detail
The vulnerability (CVE-2014-0229) in Apache Hadoop allows remote authenticated users to perform unauthorized operations or cause a denial of service. Specifically, the HDFS admin commands refreshNamenodes, deleteBlockPool, and shutdownDatanode do not check authorization, enabling authenticated users to issue these commands without proper validation. This can lead to unnecessary operations being performed or a complete shutdown of DataNodes, resulting in a denial of service.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 0.23.0, < 0.23.110.23.11 -
>= 2.0.0, < 2.4.12.4.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring proper access control and authentication mechanisms are in place to restrict unauthorized access to Hadoop clusters.
Conclusion
The vulnerability in Apache Hadoop (CVE-2014-0229) allows remote authenticated users to perform unauthorized operations or cause a denial of service. To mitigate this risk, it is recommended to upgrade to the fixed versions of Apache Hadoop. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.hadoop:hadoop-common →
FAQ
Apache Hadoop is an open-source framework for distributed storage and processing of large datasets. It provides a scalable and reliable platform for big data analytics.
The vulnerable package is org.apache.hadoop:hadoop-common, which is a core component of Apache Hadoop and includes common utilities and libraries used by other Hadoop modules.
The vulnerability allows remote authenticated users to perform unauthorized operations or cause a denial of service by exploiting certain HDFS admin commands.
To fix this vulnerability, you need to upgrade to a fixed version of Apache Hadoop. For versions 0.23.x, upgrade to version 0.23.11 or later. For versions 2.x, upgrade to version 2.4.1 or later.
While there is no specific workaround mentioned, you can mitigate the risk by implementing proper access control and authentication mechanisms in your Hadoop clusters.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.hadoop:hadoop-common.
