CVE-2015-1776: Exposure of Sensitive Information to an Unauthorized Actor in Apache Hadoop

org.apache.hadoop:hadoop-common Updated 02 Oct 2025

Summary

17/05/2022

Disclosed on

CVE-2015-1776

CVE

Yes i

Fix available

Moderate

Severity

6.2

CVSS Score

CVE-2015-1776: Exposure of Sensitive Information to an Unauthorized Actor in Apache Hadoop. Affects org.apache.hadoop:hadoop-common versions >= 2.6.0, < 2.6.5. Fixed in 2.6.5. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Apache Hadoop is an open-source framework used for distributed storage and processing of large datasets. It provides a scalable and reliable platform for big data analytics. The 'hadoop-common' package is a core component of Apache Hadoop, responsible for providing common utilities and libraries. This package is widely used in various Hadoop deployments and applications.

Vulnerability Detail

The vulnerability identified as CVE-2015-1776 affects Apache Hadoop versions 2.6.0 to 2.6.4. When the Intermediate data encryption feature is enabled, Apache Hadoop 2.6.x encrypts intermediate data generated by a MapReduce job and stores it along with the encryption key in a credentials file on disk. This file is not properly protected, allowing local users to read its contents and obtain sensitive information. An unauthorized actor with access to the credentials file can potentially decrypt the encrypted intermediate data, leading to the exposure of sensitive information.

How To Fix

Minimum fixed version

2.6.5

This is the first release that contains the fix.

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that the credentials file is properly secured and accessible only to authorized users. Additionally, monitoring and restricting access to the file can help prevent unauthorized actors from obtaining sensitive information.

Conclusion

The vulnerability CVE-2015-1776 in Apache Hadoop exposes sensitive information to unauthorized actors. Upgrading to Apache Hadoop version 2.6.5 or later is the recommended solution. Securing the credentials file and monitoring access can also help mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for org.apache.hadoop:hadoop-common →