Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 8 Nov 2017 15:51:54 +0900
From: Akira Ajisaka <>
Subject: [SECURITY] CVE-2017-3166: Apache Hadoop Privilege escalation

CVE-2017-3166: Apache Hadoop Privilege escalation vulnerability

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected:
Hadoop 2.6.1+, 2.7.x before 2.7.4, 3.0.0-alpha before 3.0.0-alpha4

In a cluster where the YARN user has been granted access to all HDFS
encryption keys, if a file in an encryption zone with access permissions
that make it world readable is localized via YARN's localization mechanism,
e.g. via the MapReduce distributed cache, that file will be stored
in a world-readable location and shared freely with any application
that requests to localize that file, no matter who the application owner
is or whether that user should be allowed to access files from the
target encryption zone.

Users on 2.6.1+ and 2.7.x before 2.7.4 should upgrade to 2.7.4 or later
Users on 3.0.0-alpha before 3.0.0-alpha4 should upgrade to 3.0.0-alpha4 or later

Users may gain access to files that should be protected by HDFS
transparent encryption if those files have world readable access
permissions and are localized through YARN's localization mechanism
in a cluster where YARN has been granted access to all HDFS encryption keys.

This issue was discovered by Luke Herbert.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.