CVE-2017-3162: Improper Input Validation in Apache Hadoop
Summary
CVE-2017-3162: Improper Input Validation in Apache Hadoop. Affects org.apache.hadoop:hadoop-client versions < 2.7.0. Fixed in 2.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Hadoop is an open-source framework used for distributed storage and processing of large datasets. It provides a scalable and reliable platform for big data analytics. The 'org.apache.hadoop:hadoop-client' package is a Maven package that includes HDFS clients, which interact with a servlet on the DataNode to browse the HDFS namespace. This package is vulnerable to an improper input validation issue.
Vulnerability Detail
The vulnerability in Apache Hadoop before version 2.7.0 arises due to the lack of validation of the NameNode query parameter in the HDFS client servlet. This allows an attacker to provide a malicious NameNode value, which can lead to various security issues. The impact of this vulnerability can range from unauthorized access to sensitive data to potential remote code execution.
How To Fix
Minimum fixed version
2.7.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version is not immediately feasible, a temporary workaround can be implemented by manually validating the NameNode query parameter in the HDFS client servlet. This can be done by adding input validation logic to ensure only legitimate values are accepted.
Conclusion
In conclusion, the 'org.apache.hadoop:hadoop-client' package in Apache Hadoop is vulnerable to an improper input validation issue. Upgrading to version 2.7.0 or later is the recommended solution. If immediate upgrade is not possible, implementing manual input validation can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.hadoop:hadoop-client →
FAQ
Apache Hadoop is an open-source framework for distributed storage and processing of big data.
It is a Maven package that includes HDFS clients for interacting with the HDFS namespace.
The vulnerability can lead to unauthorized access to sensitive data and potential remote code execution.
Upgrade to Apache Hadoop version 2.7.0 or later, or manually validate the NameNode query parameter.
Yes, you can manually validate the NameNode query parameter in the HDFS client servlet.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.hadoop:hadoop-client.
