Vulnerability Description
In Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6, KMS blocking users or granting access to users incorrectly, if the system uses non-default groups mapping mechanisms.
CVSS Score
7.4
HIGH
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Hadoop | >= 2.7.5, <= 2.7.6 |
Related Weaknesses (CWE)
References
- https://lists.apache.org/thread.html/246cf223e7dc0c1dff90b78dccb6c3fe94e1a044dbf
- https://lists.apache.org/thread.html/5a44590b4eedc5e25f5bd3081d1631b52c174b5b991
- https://lists.apache.org/thread.html/5fb771f66946dd5c99a8a5713347c24873846f555d7
- https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b667
- https://security.netapp.com/advisory/ntap-20190416-0009/
- https://lists.apache.org/thread.html/246cf223e7dc0c1dff90b78dccb6c3fe94e1a044dbf
- https://lists.apache.org/thread.html/5a44590b4eedc5e25f5bd3081d1631b52c174b5b991
- https://lists.apache.org/thread.html/5fb771f66946dd5c99a8a5713347c24873846f555d7
- https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b667
- https://security.netapp.com/advisory/ntap-20190416-0009/
FAQ
What is CVE-2018-11767?
CVE-2018-11767 is a vulnerability with a CVSS score of 7.4 (HIGH). In Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6, KMS blocking users or granting access to users incorrectly, if the system uses non-default groups mapping mechanisms.
How severe is CVE-2018-11767?
CVE-2018-11767 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-11767?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Hadoop.