Vulnerability · Published Jan 26, 2021 · Assigned by apache
CVE-2020-9492
High 8.8
In plain English
A high-severity security flaw in Apache Hadoop. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.5% (higher than 92% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)8.8High
Exploit odds (30 days)4.5%top 8.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without proper verification.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.hadoop:hadoop-common | 3.2.2 | GHSA-f8vc-wfc8-hxqh |
| Maven | org.apache.hadoop:hadoop-common | 3.1.4 | GHSA-f8vc-wfc8-hxqh |
| Maven | org.apache.hadoop:hadoop-common | 2.10.1 | GHSA-f8vc-wfc8-hxqh |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Apache Hadoop | Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, 2.0.0-alpha to 2.10.0 |
References
- https://lists.apache.org/thread.html/r513758942356ccd0d14538ba18a09903fc72716d74be1cb727ea91ff%40%3Cgeneral.hadoop.apache.org%3E x_refsource_MISC
- [announce] 20210125 [CVE-2020-9492] Apache Hadoop Potential privilege escalation mailing-list, x_refsource_MLIST
- [druid-commits] 20210203 [GitHub] [druid] jihoonson opened a new pull request #10847: Suppress CVE-2020-9492 for hadoop-mapreduce-client-core mailing-list, x_refsource_MLIST
- [druid-commits] 20210203 [GitHub] [druid] jihoonson commented on pull request #10847: Suppress CVE-2020-9492 for hadoop-mapreduce-client-core mailing-list, x_refsource_MLIST
- [druid-commits] 20210203 [GitHub] [druid] jihoonson merged pull request #10847: Suppress CVE-2020-9492 for hadoop-mapreduce-client-core mailing-list, x_refsource_MLIST
- [druid-commits] 20210225 [GitHub] [druid] liangrui1988 commented on pull request #10847: Suppress CVE-2020-9492 for hadoop-mapreduce-client-core mailing-list, x_refsource_MLIST
- [solr-issues] 20210419 [jira] [Updated] (SOLR-15355) CVE-2020-9492: Upgrade hadoop-hdfs-client to 3.2.2 mailing-list, x_refsource_MLIST
- [solr-issues] 20210419 [jira] [Created] (SOLR-15355) CVE-2020-9492: Upgrade hadoop-hdfs-client to 3.2.2 mailing-list, x_refsource_MLIST
- [solr-issues] 20210623 [jira] [Updated] (SOLR-15355) CVE-2020-9492: Upgrade hadoop-hdfs-client to 3.2.2 mailing-list, x_refsource_MLIST
- [solr-issues] 20210702 [jira] [Commented] (SOLR-15355) CVE-2020-9492: Upgrade hadoop-hdfs-client to 3.2.2 mailing-list, x_refsource_MLIST
- [solr-issues] 20211016 [jira] [Commented] (SOLR-15355) CVE-2020-9492: Upgrade hadoop-hdfs-client to 3.2.2 mailing-list, x_refsource_MLIST
- [solr-issues] 20211015 [jira] [Resolved] (SOLR-15355) CVE-2020-9492: Upgrade hadoop-hdfs-client to 3.2.2 mailing-list, x_refsource_MLIST
- [solr-issues] 20211020 [jira] [Commented] (SOLR-15355) CVE-2020-9492: Upgrade hadoop-hdfs-client to 3.2.2 mailing-list, x_refsource_MLIST
- [solr-issues] 20211022 [jira] [Commented] (SOLR-15355) CVE-2020-9492: Upgrade hadoop-hdfs-client to 3.2.2 mailing-list, x_refsource_MLIST
- https://www.oracle.com/security-alerts/cpujul2022.html x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20210304-0001/ x_refsource_CONFIRM