CVE-2017-3166: Vulnerability in org.apache.hadoop:hadoop-main
Summary
CVE-2017-3166: Moderate severity vulnerability that affects org.apache.hadoop:hadoop-main. Affects org.apache.hadoop:hadoop-main versions < 2.7.3. Fixed in 2.7.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.apache.hadoop:hadoop-main is a Maven package that is part of the Apache Hadoop ecosystem. It provides core functionality for the Hadoop distributed computing framework. This package is vulnerable to a moderate severity issue.
Vulnerability Detail
The vulnerability (CVE-2017-3166) affects Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1. When a file in an encryption zone with access permissions that make it world readable is localized via YARN's localization mechanism, the file is stored in a world-readable location. This allows any application that requests to localize the file to freely access and share its contents. The vulnerability has a CVSSv3 score of 7.8 (High).
How To Fix
Latest published version: 3.5.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.7.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to upgrade to a fixed version of Apache Hadoop to address the issue.
Conclusion
In conclusion, the org.apache.hadoop:hadoop-main package is vulnerable to a moderate severity issue (CVE-2017-3166) that allows unauthorized access to files in encryption zones. To mitigate this vulnerability, it is crucial to upgrade to a fixed version of Apache Hadoop. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.apache.hadoop:hadoop-main →
FAQ
The vulnerability allows unauthorized access to files in encryption zones, potentially exposing sensitive information to unauthorized users.
Versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1 are affected.
No, upgrading to a fixed version is the only solution.
The CVSSv3 score of this vulnerability is 7.8 (High).
For more information, you can visit the vulnerability's page on the Vulert website: Vulert Scanner
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.hadoop:hadoop-main.
