oss-sec mailing list archives
[SECURITY] CVE-2017-3166: Apache Hadoop Privilege escalation vulnerability
From: Akira Ajisaka <aajisaka () apache org>
Date: Wed, 8 Nov 2017 15:51:54 +0900
CVE-2017-3166: Apache Hadoop Privilege escalation vulnerability Severity: Important Vendor: The Apache Software Foundation Versions Affected: Hadoop 2.6.1+, 2.7.x before 2.7.4, 3.0.0-alpha before 3.0.0-alpha4 Description: In a cluster where the YARN user has been granted access to all HDFS encryption keys, if a file in an encryption zone with access permissions that make it world readable is localized via YARN's localization mechanism, e.g. via the MapReduce distributed cache, that file will be stored in a world-readable location and shared freely with any application that requests to localize that file, no matter who the application owner is or whether that user should be allowed to access files from the target encryption zone. Mitigation: Users on 2.6.1+ and 2.7.x before 2.7.4 should upgrade to 2.7.4 or later Users on 3.0.0-alpha before 3.0.0-alpha4 should upgrade to 3.0.0-alpha4 or later Impact: Users may gain access to files that should be protected by HDFS transparent encryption if those files have world readable access permissions and are localized through YARN's localization mechanism in a cluster where YARN has been granted access to all HDFS encryption keys. Credit: This issue was discovered by Luke Herbert.
Current thread:
- [SECURITY] CVE-2017-3166: Apache Hadoop Privilege escalation vulnerability Akira Ajisaka (Nov 08)