CVE-2021-36151: Apache Gobblin - Hadoop Token Exposure
Summary
CVE-2021-36151: Hadoop token in temp file visible to all users in Apache Gobblin. Affects org.apache.gobblin:gobblin-core versions < 0.16.0. Fixed in 0.16.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Gobblin is an open-source data integration framework for Apache Hadoop. It provides a unified interface for ingesting, transforming, and delivering data across various data sources. The 'gobblin-core' package is a key component of Apache Gobblin, responsible for core functionalities such as data ingestion and processing. However, versions up to 0.15.0 of 'gobblin-core' are vulnerable to a security issue.
Vulnerability Detail
The vulnerability (CVE-2021-36151) in Apache Gobblin allows the Hadoop token to be written to a temporary file that is accessible to all local users on Unix-like systems. This means that any user on the system can potentially access and misuse the Hadoop token, leading to unauthorized access to Hadoop resources. The issue has a CVSSv3 score of 5.5, indicating a moderate severity level. It is important to address this vulnerability to prevent potential data breaches and unauthorized access to sensitive information.
How To Fix
Minimum fixed version
0.16.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in Apache Gobblin (CVE-2021-36151) exposes the Hadoop token to all local users on Unix-like systems, potentially leading to unauthorized access to Hadoop resources. To mitigate this risk, users should update to version 0.16.0 or later of 'gobblin-core'. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.gobblin:gobblin-core →
FAQ
Apache Gobblin is an open-source data integration framework for Apache Hadoop, designed to simplify the process of ingesting, transforming, and delivering data across various data sources.
The vulnerability allows the Hadoop token to be accessed by any local user on Unix-like systems, potentially leading to unauthorized access to Hadoop resources and data breaches.
Versions up to 0.15.0 of 'gobblin-core' are affected by this vulnerability.
Updating to version 0.16.0 or later of 'gobblin-core' will address this vulnerability and ensure the Hadoop token is securely handled.
No specific workaround is mentioned for this vulnerability. It is recommended to update to the latest version of 'gobblin-core' to fix the issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.gobblin:gobblin-core.
