Input validation error in Hadoop - CVE-2017-15718
Published: January 24, 2018 / Updated: August 8, 2020
Vulnerability identifier: #VU37593
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-15718
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications.
Affected software
Hadoop
Fedora
hadoop
Cloudera Data Platform Private Cloud Base for IBM
Fedora
hadoop
Cloudera Data Platform Private Cloud Base for IBM
How to mitigate CVE-2017-15718
Install update from vendor's website.
hadoop - addressed in versions 2.7.6-2.fc28, 2.7.6-4.fc28
Cloudera Data Platform Private Cloud Base for IBM - update to 7.1.9.3 HF2
Cloudera Data Platform Private Cloud Base for IBM - update to 7.1.9.3 HF2