Vulnerability · Published Jun 15, 2022 · Assigned by apache
CVE-2021-33036Apache Hadoop Privilege escalation vulnerability
High 8.8
In plain English
A high-severity security flaw in Apache Hadoop from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.0% (higher than 91% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)8.8High
Exploit odds (30 days)4.0%top 9.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.hadoop:hadoop-yarn-server-common | 2.10.2 | GHSA-58jx-f5rf-qgqf |
| Maven | org.apache.hadoop:hadoop-yarn-server-common | 3.2.3 | GHSA-58jx-f5rf-qgqf |
| Maven | org.apache.hadoop:hadoop-yarn-server-common | 3.3.2 | GHSA-58jx-f5rf-qgqf |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Hadoop | 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1 |
Weakness: CWE-264, CWE-24
References
- https://lists.apache.org/thread/ctr84rmo3xd2tzqcx2b277c8z692vhl5 x_refsource_MISC
- [oss-security] 20220615 CVE-2021-33036: Apache Hadoop Privilege escalation vulnerability mailing-list, x_refsource_MLIST
- https://security.netapp.com/advisory/ntap-20220722-0003/ x_refsource_CONFIRM