Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2016-5001

This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of HDFS. A local user on an HDFS DataNode ma

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of HDFS. A local user on an HDFS DataNode may be able to craft a block token that grants unauthorized read access to random files by guessing certain fields in the token.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache Hadoop

  • 2.1.0 to 2.6.3affected
  • 2.7.0 to 2.7.1affected

References