Vulnerability Description
ZKConfigurationStore which is optionally used by CapacityScheduler of Apache Hadoop YARN deserializes data obtained from ZooKeeper without validation. An attacker having access to ZooKeeper can run arbitrary commands as YARN user by exploiting this. Users should upgrade to Apache Hadoop 2.10.2, 3.2.4, 3.3.4 or later (containing YARN-11126) if ZKConfigurationStore is used.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Hadoop | >= 2.9.0, < 2.10.2 |
Related Weaknesses (CWE)
References
- https://lists.apache.org/thread/g6vf2h4wdgzzdgk91mqozhs58wotq150Mailing ListVendor Advisory
- https://security.netapp.com/advisory/ntap-20221201-0003/Third Party Advisory
- https://lists.apache.org/thread/g6vf2h4wdgzzdgk91mqozhs58wotq150Mailing ListVendor Advisory
- https://security.netapp.com/advisory/ntap-20221201-0003/Third Party Advisory
FAQ
What is CVE-2021-25642?
CVE-2021-25642 is a vulnerability with a CVSS score of 8.8 (HIGH). ZKConfigurationStore which is optionally used by CapacityScheduler of Apache Hadoop YARN deserializes data obtained from ZooKeeper without validation. An attacker having access to ZooKeeper can run ar...
How severe is CVE-2021-25642?
CVE-2021-25642 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-25642?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Hadoop.