oss-sec mailing list archives
CVE-2018-11765: Potential information disclosure in Hadoop Web interfaces
From: Akira Ajisaka <aajisaka () apache org>
Date: Mon, 28 Sep 2020 14:42:30 +0900
CVE-2018-11765: Potential information disclosure in Hadoop Web interfaces Severity: Important Vendor: The Apache Software Foundation Versions affected: 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5 Description: When Kerberos authentication is enabled and SPNEGO through HTTP is not enabled, any users can access some servlets without authentication. Mitigation: Users should upgrade to Apache Hadoop 2.10.0, 3.0.1 or upper. If you are using the affected version of Apache Hadoop, you need to enable SPNEGO through HTTP. Credit: This issue was discovered by Owen O'Malley and reported by Larry McCay.
Current thread:
- CVE-2018-11765: Potential information disclosure in Hadoop Web interfaces Akira Ajisaka (Sep 27)