CVE-2017-7669

CWE-20 — Improper Input Validation5 documents5 sources
Severity
7.5HIGH
EPSS
0.3%
top 46.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache HadoopApache Hadoop
Timeline
PublishedJun 5
Latest updateMay 17

Description

In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.6 | Impact: 5.9

Affected Packages3 packages

▶Mavenorg.apache.hadoop:hadoop-common3.0.0-alpha1 — 3.0.0-alpha3+1
▶NVDapache/hadoop2.8.0, 3.0.0+1
▶CVEListV5apache_software_foundation/apache_hadoop2.8.0, 3.0.0-alpha1 and 3.0.0-alpha2+1

🔴Vulnerability Details

3
GHSA
Apache Hadoop's LinuxContainerExecutor runs docker commands as root with insufficient input validation↗2022-05-17
▶
OSV
Apache Hadoop's LinuxContainerExecutor runs docker commands as root with insufficient input validation↗2022-05-17
▶
CVEList
CVE-2017-7669: In Apache Hadoop 2↗2017-06-02
▶

💬Community

1
Bugzilla
CVE-2017-3162 CVE-2017-3161 CVE-2017-7669 hadoop: Multiple vulnerabilities↗2017-05-05
▶