Permissions, Privileges, and Access Controls in Hadoop - CVE-2021-33036

Vulnerability identifier: #VU64513

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-33036

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to improper permission assignment, which leads to security restrictions bypass and privilege escalation.

Hadoop
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Cloud Application Performance Management (APM)
IBM Qradar SIEM
openEuler
libhdfs
hadoop-tests
hadoop-client
hadoop-httpfs
hadoop-maven-plugin
hadoop-hdfs
hadoop-mapreduce-examples
hadoop-yarn
hadoop-common
hadoop-debugsource
hadoop-yarn-security
hadoop-debuginfo
hadoop-common-native
hadoop-devel
hadoop
hadoop-mapreduce

Install updates from vendor's website.

Hadoop - addressed in versions 2.10.2, 3.2.3, 3.3.2
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.3
IBM Qradar SIEM - addressed in versions 7.4.3 Fix Pack 6, 7.5.0 Update Pack 3
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.19
libhdfs - update to 3.3.4-1
hadoop-tests - update to 3.3.4-1
hadoop-client - update to 3.3.4-1
hadoop-httpfs - update to 3.3.4-1
hadoop-maven-plugin - update to 3.3.4-1
hadoop-hdfs - update to 3.3.4-1
hadoop-mapreduce-examples - update to 3.3.4-1
hadoop-yarn - update to 3.3.4-1
hadoop-common - update to 3.3.4-1
hadoop-debugsource - update to 3.3.4-1
hadoop-yarn-security - update to 3.3.4-1
hadoop-debuginfo - update to 3.3.4-1
hadoop-common-native - update to 3.3.4-1
hadoop-devel - update to 3.3.4-1
hadoop - update to 3.3.4-1
hadoop-mapreduce - update to 3.3.4-1

• https://lists.apache.org/thread/ctr84rmo3xd2tzqcx2b277c8z692vhl5
• http://www.openwall.com/lists/oss-security/2022/06/15/2

• Multiple vulnerabilities in Apache Hadoop
• Multiple vulnerabilities in IBM QRadar SIEM
• openEuler update for hadoop
• Multiple vulnerabilities in IBM Knowledge Catalog for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Application Performance Management