{
"id": "GHSA-37pw-qw47-4jxm",
"aliases": [
"CVE-2018-8029"
],
"details": "In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.",
"summary": "Privilege escalation vulnerability in Apache Hadoop",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.8.4"
}
]
}
],
"package": {
"name": "org.apache.hadoop:hadoop-main",
"ecosystem": "Maven"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.9.0"
},
{
"fixed": "2.9.2"
}
]
}
],
"package": {
"name": "org.apache.hadoop:hadoop-main",
"ecosystem": "Maven"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.1.1"
}
]
}
],
"package": {
"name": "org.apache.hadoop:hadoop-main",
"ecosystem": "Maven"
}
}
],
"modified": "2021-05-11T16:17:59Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"published": "2019-05-31T16:09:15Z",
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8029",
"type": "ADVISORY"
},
{
"url": "https://lists.apache.org/thread.html/0b8d58e02dbd0fb8bf7320c514fe58da1d6728bdc150f1ba04e0d9fc@%3Cissues.hbase.apache.org%3E",
"type": "WEB"
},
{
"url": "https://lists.apache.org/thread.html/17084c09e6dedf60efe08028b429c92ffd28aacc28454e4fa924578a@%3Cgeneral.hadoop.apache.org%3E",
"type": "WEB"
},
{
"url": "https://lists.apache.org/thread.html/a0164b87660223a2d491f83c88f905fe1a9fa8dc795148d9b0d968c8@%3Cdev.hbase.apache.org%3E",
"type": "WEB"
},
{
"url": "https://lists.apache.org/thread.html/a97c53a81e639ca2fc7b8f61a4fcd1842c2a78544041244a7c624727@%3Cissues.hbase.apache.org%3E",
"type": "WEB"
},
{
"url": "https://lists.apache.org/thread.html/r4dddf1705dbedfa94392913b2dad1cd2d1d89040facd389eea0b3510@%3Ccommits.druid.apache.org%3E",
"type": "WEB"
},
{
"url": "https://lists.apache.org/thread.html/rb21df54a4e39732ce653d2aa5672e36a792b59eb6717f2a06bb8d02a@%3Ccommits.druid.apache.org%3E",
"type": "WEB"
},
{
"url": "https://security.netapp.com/advisory/ntap-20190617-0001",
"type": "WEB"
},
{
"url": "http://www.securityfocus.com/bid/108518",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-285"
],
"severity": "HIGH",
"github_reviewed": true,
"nvd_published_at": null,
"github_reviewed_at": "2019-05-31T16:08:38Z"
}
}