Business information leak In org.apache.hadoop:hadoop-common
Description
Exposure of Sensitive Information to an Unauthorized Actor in Apache Hadoop This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of HDFS. A local user on an HDFS DataNode may be able to craft a block token that grants unauthorized read access to random files by guessing certain fields in the token.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 maven | 2.6.4, 2.7.2 |
Aliases
1. 2. 3. 4.
References
1. 2.