Description

The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for credential store provider used by the NodeManager to YARN Applications.

Remediation

References

http://mail-archives.apache.org/mod_mbox/hadoop-general/201701.mbox/%3C0ed32746-5a53-9051-5877-2b1abd88beb6%40apache.org%3E

http://www.securityfocus.com/bid/95335

Related Vulnerabilities

CVE-2023-2798 Vulnerability in maven package net.sourceforge.htmlunit:htmlunit

CVE-2023-28677 Vulnerability in maven package org.jenkins-ci.plugins:convert-to-pipeline

CVE-2021-23434 Vulnerability in npm package object-path

CVE-2019-16552 Vulnerability in maven package com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger

CVE-2021-30074 Vulnerability in npm package docsify

Severity

Critical

Classification

CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Mitigation Vendor Advisory VDB Entry Third Party Advisory