GHSA-895m-ww55-59vw

Exposure of Sensitive Information to an Unauthorized Actor in Apache Hadoop

At a glance

Published: 2022-05-17 01:08 UTC
Updated: 2023-11-08 03:58 UTC
CVE: CVE-2016-3086
CVSS_V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for credential store provider used by the NodeManager to YARN Applications.

Affected packages

Package	Versions
Maven · org.apache.hadoop:hadoop-yarn-server-nodemanager	introduced 2.6.0, fixed 2.6.5
Maven · org.apache.hadoop:hadoop-yarn-server-nodemanager	introduced 2.7.0, fixed 2.7.3

References

https://nvd.nist.gov/vuln/detail/CVE-2016-3086 ADVISORY
http://mail-archives.apache.org/mod_mbox/hadoop-general/201701.mbox/%3C0ed32746-5a53-9051-5877-2b1abd88beb6%40apache.org%3E WEB
http://www.securityfocus.com/bid/95335 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database