CVE-2017-15713: Vulnerability in org.apache.hadoop:hadoop-main
Summary
CVE-2017-15713: Moderate severity vulnerability that affects org.apache.hadoop:hadoop-main. Affects org.apache.hadoop:hadoop-main across 2 version ranges.
< 2.7.5
>= 2.8.0, < 2.8.3
Fixed in 2.7.5 or 2.8.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.apache.hadoop:hadoop-main is a Maven package that provides the main components and functionality for Apache Hadoop. It is widely used for distributed processing of large datasets across clusters of computers. This package includes the MapReduce framework, which is responsible for processing and analyzing data in parallel. However, a vulnerability has been identified in versions 0.23.x, 2.x before 2.7.5, 2.8.x before 2.8.3, and 3.0.0-alpha through 3.0.0-beta1 of Apache Hadoop, which allows a cluster user to expose private files owned by the user running the MapReduce job history server process. This vulnerability can be exploited by a malicious user who constructs a configuration file containing XML directives that reference sensitive files on the MapReduce job history server host.
Vulnerability Detail
The vulnerability in org.apache.hadoop:hadoop-main arises from a flaw in the MapReduce job history server process. By crafting a malicious configuration file, an attacker can manipulate XML directives to access private files on the server host. This can lead to unauthorized disclosure of sensitive information, potentially compromising the security and privacy of the affected system. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Latest published version: 3.5.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.7.52.7.5 -
>= 2.8.0, < 2.8.32.8.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to a fixed version of Apache Hadoop.
Conclusion
In conclusion, the vulnerability in org.apache.hadoop:hadoop-main exposes private files on the MapReduce job history server host, potentially leading to unauthorized disclosure of sensitive information. It is crucial to upgrade to a fixed version of Apache Hadoop to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.hadoop:hadoop-main →
FAQ
Apache Hadoop is an open-source framework for distributed processing of large datasets across clusters of computers. It provides a scalable and reliable platform for storing, processing, and analyzing big data.
The MapReduce framework is a key component of Apache Hadoop. It allows for parallel processing of data across a cluster of computers, enabling efficient and scalable data processing.
This vulnerability allows a cluster user to access private files owned by the user running the MapReduce job history server process. It can lead to unauthorized disclosure of sensitive information and compromise the security and privacy of the affected system.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
Detailed instructions on how to upgrade Apache Hadoop can be found in the official Apache Hadoop documentation.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.hadoop:hadoop-main.
