CVE-2018-1296
published 2019-02-07CVE-2018-1296: In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, HDFS exposes extended attribute key/value pairs during listXAttrs, verifying…
PriorityP342high7.5CVSS 3.0
AVNACLPRNUINSUCHINAN
EPSS
3.30%
87.2th percentile
In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, HDFS exposes extended attribute key/value pairs during listXAttrs, verifying only path-level search access to the directory rather than path-level read permission to the referent.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | hadoop | — | — |
| apache | hadoop | — | — |
| apache | hadoop | — | — |
| apache | hadoop | — | — |
| apache | hadoop | — | — |
| apache | hadoop | — | — |
| apache | hadoop | — | — |
| apache | hadoop | 2.5.0 – 2.7.5 | — |
| apache_software_foundation | apache_hadoop | — | — |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vendor_apache7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Exposure of Sensitive Information to an Unauthorized Actor in Hadoop
ghsa·2019-02-12
CVE-2018-1296 [HIGH] CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in Hadoop
Exposure of Sensitive Information to an Unauthorized Actor in Hadoop
In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, HDFS exposes extended attribute key/value pairs during listXAttrs, verifying only path-level search access to the directory rather than path-level read permission to the referent.
OSV
Exposure of Sensitive Information to an Unauthorized Actor in Hadoop
osv·2019-02-12
CVE-2018-1296 [HIGH] Exposure of Sensitive Information to an Unauthorized Actor in Hadoop
Exposure of Sensitive Information to an Unauthorized Actor in Hadoop
In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, HDFS exposes extended attribute key/value pairs during listXAttrs, verifying only path-level search access to the directory rather than path-level read permission to the referent.
Red Hat
hadoop: HDFS Permissive listXAttr Authorization
vendor_redhat·2019-01-24·CVSS 7.5
CVE-2018-1296 [HIGH] CWE-285 hadoop: HDFS Permissive listXAttr Authorization
hadoop: HDFS Permissive listXAttr Authorization
In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, HDFS exposes extended attribute key/value pairs during listXAttrs, verifying only path-level search access to the directory rather than path-level read permission to the referent.
Mitigation: If a file contains sensitive data in extended attributes, users and admins need to change the permission to prevent others from listing the directory which contains the file.
Package: rhs-hadoop (Red Hat Enterprise Linux 6) - Not affected
Package: hadoop (Red Hat Fuse 7) - Will not fix
Package: hadoop (Red Hat JBoss Fuse 6) - Out of support scope
Package: rhs-hadoop (Red Hat Storage 3) - Not affected
Apache
Apache hadoop: CVE-2018-1296
vendor_apache·CVSS 7.5
CVE-2018-1296 [HIGH] Apache hadoop: CVE-2018-1296
Apache hadoop: CVE-2018-1296
HDFS exposes extended attribute key/value pairs during listXAttrs, verifying only path-level search access to the directory rather than path-level read permission to the referent. This affects features that store sensitive data in extended attributes, such as HDFS encryption secrets.
No detection rules found.
No public exploits indexed.
http://www.securityfocus.com/bid/106764https://lists.apache.org/thread.html/a5b15bc76fbdad2ee40761aacf954a13aeef67e305f86d483f267e8e%40%3Cuser.hadoop.apache.org%3Ehttp://www.securityfocus.com/bid/106764https://lists.apache.org/thread.html/a5b15bc76fbdad2ee40761aacf954a13aeef67e305f86d483f267e8e%40%3Cuser.hadoop.apache.org%3E
2019-02-07
Published