NetSight
IP …
high7.5

CVE-2018-11768

user/group information can be corrupted across storing in fsimage and reading back from fsimage

Impact

In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be corrupted across storing in fsimage and reading back from fsimage.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.hadoop:hadoop-main>= 2.2.0, < 2.8.52.8.5

Affected products

VendorProductAffected versions
ApacheHadoop
from 2.2.0 through 2.8.4
from 2.9.0 through 2.9.1
from 3.0.1 through 3.0.3
from 3.1.0 through 3.1.1
Versions 2.0.0, 2.0.1

Weakness classification

CWE-119

References