CVE-2017-15718: Exposure of Sensitive Information in Hadoop
Summary
CVE-2017-15718: Exposure of Sensitive Information in Hadoop. Affects org.apache.hadoop:hadoop-main versions >= 2.7.3, < 2.7.5. Fixed in 2.7.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Apache Hadoop package, specifically the YARN NodeManager component, is a distributed processing framework for big data. It provides resource management and job scheduling capabilities. The vulnerability affects versions 2.7.3 and 2.7.4 of the org.apache.hadoop:hadoop-main package.
Vulnerability Detail
The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 is susceptible to an information exposure vulnerability. This vulnerability allows the password for the credential store provider used by the NodeManager to be leaked to YARN Applications. An attacker with access to the YARN Applications could potentially obtain sensitive information, compromising the security of the system.
How To Fix
Latest published version: 3.5.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.7.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to upgrade to the fixed version as soon as possible.
Conclusion
The exposure of sensitive information vulnerability in Apache Hadoop 2.7.3 and 2.7.4 can be mitigated by upgrading to version 2.7.5 or a later release. It is important to promptly apply the necessary security patches to protect against potential information leaks and unauthorized access. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.hadoop:hadoop-main →
FAQ
Apache Hadoop is a distributed processing framework for big data. It provides resource management and job scheduling capabilities.
The YARN NodeManager is a component of Apache Hadoop that manages resources and executes tasks on individual nodes in a Hadoop cluster.
A credential store provider is a mechanism used by the NodeManager to securely store and retrieve credentials required for authentication and authorization.
This vulnerability could allow an attacker to obtain sensitive information, potentially leading to unauthorized access or other security breaches.
Yes, upgrading to version 2.7.5 or a later release of the org.apache.hadoop:hadoop-main package will address this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.hadoop:hadoop-main.
