Deserialization of Untrusted Data in Hadoop - CVE-2021-25642
Published: June 2, 2025
Vulnerability identifier: #VU110016
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-25642
CWE-ID: CWE-502
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to ZKConfigurationStore which is optionally used by CapacityScheduler of Apache Hadoop YARN deserializes data obtained from ZooKeeper without validation. A remote user with an access to ZooKeeper can run arbitrary commands as YARN user by exploiting this vulnerability.
Affected software
Hadoop
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM InfoSphere Information Server
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM InfoSphere Information Server
How to mitigate CVE-2021-25642
Install updates from vendor's website.
Hadoop - addressed in versions 2.10.2, 3.2.4, 3.3.4
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.3
IBM InfoSphere Information Server - update to 11.7.1.6 Service pack 3
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.3
IBM InfoSphere Information Server - update to 11.7.1.6 Service pack 3