jiachao2130/cvrf2cusa
1
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
main
cvrf2cusa/cvrf/2022/cvrf-openEuler-SA-2022-2092.xml
Jia Chao 0b34274085 git mv 
Signed-off-by: Jia Chao <jiac13@chinaunicom.cn>
2024-07-25 09:57:37 +08:00

239 lines
21 KiB
XML
Raw Permalink Blame History

<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns="http://www.icasi.org/CVRF/schema/cvrf/1.1" xmlns:cvrf="http://www.icasi.org/CVRF/schema/cvrf/1.1">
<DocumentTitle xml:lang="en">An update for hadoop is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3 and openEuler-22.03-LTS</DocumentTitle>
<DocumentType>Security Advisory</DocumentType>
<DocumentPublisher Type="Vendor">
<ContactDetails>openeuler-security@openeuler.org</ContactDetails>
<IssuingAuthority>openEuler security committee</IssuingAuthority>
</DocumentPublisher>
<DocumentTracking>
<Identification>
<ID>openEuler-SA-2022-2092</ID>
</Identification>
<Status>Final</Status>
<Version>1.0</Version>
<RevisionHistory>
<Revision>
<Number>1.0</Number>
<Date>2022-11-11</Date>
<Description>Initial</Description>
</Revision>
</RevisionHistory>
<InitialReleaseDate>2022-11-11</InitialReleaseDate>
<CurrentReleaseDate>2022-11-11</CurrentReleaseDate>
<Generator>
<Engine>openEuler SA Tool V1.0</Engine>
<Date>2022-11-11</Date>
</Generator>
</DocumentTracking>
<DocumentNotes>
<Note Title="Synopsis" Type="General" Ordinal="1" xml:lang="en">hadoop security update</Note>
<Note Title="Summary" Type="General" Ordinal="2" xml:lang="en">An update for hadoop is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3 and openEuler-22.03-LTS.</Note>
<Note Title="Description" Type="General" Ordinal="3" xml:lang="en">Apache Hadoop is a framework that allows for the distributed processing of large data sets across clusters of computers using simple programming models. It is designed to scale up from single servers to thousands of machines, each offering local computation and storage.
Security Fix(es):
In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. As a result, a TAR entry may create a symlink under the expected extraction directory which points to an external directory. A subsequent TAR entry may extract an arbitrary file into the external directory using the symlink name. This however would be caught by the same targetDirPath check on Unix because of the getCanonicalPath call. However on Windows, getCanonicalPath doesn&apos;t resolve symbolic links, which bypasses the check. unpackEntries during TAR extraction follows symbolic links which allows writing outside expected base directory on Windows. This was addressed in Apache Hadoop 3.2.3(CVE-2022-26612)
There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may result in a denial of service or arbitrary code execution. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.(CVE-2021-37404)
Apache Hadoop&apos;s FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It has been used in Hadoop 2.x for yarn localization, which does enable remote code execution. It is used in Apache Spark, from the SQL command ADD ARCHIVE. As the ADD ARCHIVE command adds new binaries to the classpath, being able to execute shell scripts does not confer new permissions to the caller. SPARK-38305. &quot;Check existence of file before untarring/zipping&quot;, which is included in 3.3.0, 3.1.4, 3.2.2, prevents shell commands being executed, regardless of which version of the hadoop libraries are in use. Users should upgrade to Apache Hadoop 2.10.2, 3.2.4, 3.3.3 or upper (including HADOOP-18136).(CVE-2022-25168)</Note>
<Note Title="Topic" Type="General" Ordinal="4" xml:lang="en">An update for hadoop is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3 and openEuler-22.03-LTS.
openEuler Security has rated this update as having a security impact of critical. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.</Note>
<Note Title="Severity" Type="General" Ordinal="5" xml:lang="en">Critical</Note>
<Note Title="Affected Component" Type="General" Ordinal="6" xml:lang="en">hadoop</Note>
</DocumentNotes>
<DocumentReferences>
<Reference Type="Self">
<URL>https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2092</URL>
</Reference>
<Reference Type="openEuler CVE">
<URL>https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2022-26612</URL>
<URL>https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2021-37404</URL>
<URL>https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2022-25168</URL>
</Reference>
<Reference Type="Other">
<URL>https://nvd.nist.gov/vuln/detail/CVE-2022-26612</URL>
<URL>https://nvd.nist.gov/vuln/detail/CVE-2021-37404</URL>
<URL>https://nvd.nist.gov/vuln/detail/CVE-2022-25168</URL>
</Reference>
</DocumentReferences>
<ProductTree xmlns="http://www.icasi.org/CVRF/schema/prod/1.1">
<Branch Type="Product Name" Name="openEuler">
<FullProductName ProductID="openEuler-20.03-LTS-SP1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">openEuler-20.03-LTS-SP1</FullProductName>
<FullProductName ProductID="openEuler-20.03-LTS-SP3" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">openEuler-20.03-LTS-SP3</FullProductName>
<FullProductName ProductID="openEuler-22.03-LTS" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">openEuler-22.03-LTS</FullProductName>
</Branch>
<Branch Type="Package Arch" Name="aarch64">
<FullProductName ProductID="hadoop-yarn-security-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">hadoop-yarn-security-3.3.4-1.oe1.aarch64.rpm</FullProductName>
<FullProductName ProductID="libhdfs-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">libhdfs-3.3.4-1.oe1.aarch64.rpm</FullProductName>
<FullProductName ProductID="hadoop-devel-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">hadoop-devel-3.3.4-1.oe1.aarch64.rpm</FullProductName>
<FullProductName ProductID="hadoop-debugsource-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">hadoop-debugsource-3.3.4-1.oe1.aarch64.rpm</FullProductName>
<FullProductName ProductID="hadoop-common-native-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">hadoop-common-native-3.3.4-1.oe1.aarch64.rpm</FullProductName>
<FullProductName ProductID="hadoop-debuginfo-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">hadoop-debuginfo-3.3.4-1.oe1.aarch64.rpm</FullProductName>
<FullProductName ProductID="hadoop-common-native-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">hadoop-common-native-3.3.4-1.oe1.aarch64.rpm</FullProductName>
<FullProductName ProductID="hadoop-yarn-security-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">hadoop-yarn-security-3.3.4-1.oe1.aarch64.rpm</FullProductName>
<FullProductName ProductID="libhdfs-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">libhdfs-3.3.4-1.oe1.aarch64.rpm</FullProductName>
<FullProductName ProductID="hadoop-debugsource-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">hadoop-debugsource-3.3.4-1.oe1.aarch64.rpm</FullProductName>
<FullProductName ProductID="hadoop-devel-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">hadoop-devel-3.3.4-1.oe1.aarch64.rpm</FullProductName>
<FullProductName ProductID="hadoop-debuginfo-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">hadoop-debuginfo-3.3.4-1.oe1.aarch64.rpm</FullProductName>
<FullProductName ProductID="hadoop-devel-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">hadoop-devel-3.3.4-1.oe2203.aarch64.rpm</FullProductName>
<FullProductName ProductID="hadoop-debuginfo-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">hadoop-debuginfo-3.3.4-1.oe2203.aarch64.rpm</FullProductName>
<FullProductName ProductID="hadoop-debugsource-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">hadoop-debugsource-3.3.4-1.oe2203.aarch64.rpm</FullProductName>
<FullProductName ProductID="libhdfs-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">libhdfs-3.3.4-1.oe2203.aarch64.rpm</FullProductName>
<FullProductName ProductID="hadoop-common-native-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">hadoop-common-native-3.3.4-1.oe2203.aarch64.rpm</FullProductName>
<FullProductName ProductID="hadoop-yarn-security-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">hadoop-yarn-security-3.3.4-1.oe2203.aarch64.rpm</FullProductName>
</Branch>
<Branch Type="Package Arch" Name="noarch">
<FullProductName ProductID="hadoop-maven-plugin-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">hadoop-maven-plugin-3.3.4-1.oe1.noarch.rpm</FullProductName>
<FullProductName ProductID="hadoop-common-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">hadoop-common-3.3.4-1.oe1.noarch.rpm</FullProductName>
<FullProductName ProductID="hadoop-tests-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">hadoop-tests-3.3.4-1.oe1.noarch.rpm</FullProductName>
<FullProductName ProductID="hadoop-hdfs-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">hadoop-hdfs-3.3.4-1.oe1.noarch.rpm</FullProductName>
<FullProductName ProductID="hadoop-yarn-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">hadoop-yarn-3.3.4-1.oe1.noarch.rpm</FullProductName>
<FullProductName ProductID="hadoop-mapreduce-examples-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">hadoop-mapreduce-examples-3.3.4-1.oe1.noarch.rpm</FullProductName>
<FullProductName ProductID="hadoop-client-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">hadoop-client-3.3.4-1.oe1.noarch.rpm</FullProductName>
<FullProductName ProductID="hadoop-httpfs-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">hadoop-httpfs-3.3.4-1.oe1.noarch.rpm</FullProductName>
<FullProductName ProductID="hadoop-mapreduce-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">hadoop-mapreduce-3.3.4-1.oe1.noarch.rpm</FullProductName>
<FullProductName ProductID="hadoop-tests-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">hadoop-tests-3.3.4-1.oe1.noarch.rpm</FullProductName>
<FullProductName ProductID="hadoop-httpfs-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">hadoop-httpfs-3.3.4-1.oe1.noarch.rpm</FullProductName>
<FullProductName ProductID="hadoop-common-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">hadoop-common-3.3.4-1.oe1.noarch.rpm</FullProductName>
<FullProductName ProductID="hadoop-maven-plugin-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">hadoop-maven-plugin-3.3.4-1.oe1.noarch.rpm</FullProductName>
<FullProductName ProductID="hadoop-hdfs-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">hadoop-hdfs-3.3.4-1.oe1.noarch.rpm</FullProductName>
<FullProductName ProductID="hadoop-mapreduce-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">hadoop-mapreduce-3.3.4-1.oe1.noarch.rpm</FullProductName>
<FullProductName ProductID="hadoop-yarn-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">hadoop-yarn-3.3.4-1.oe1.noarch.rpm</FullProductName>
<FullProductName ProductID="hadoop-client-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">hadoop-client-3.3.4-1.oe1.noarch.rpm</FullProductName>
<FullProductName ProductID="hadoop-mapreduce-examples-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">hadoop-mapreduce-examples-3.3.4-1.oe1.noarch.rpm</FullProductName>
<FullProductName ProductID="hadoop-common-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">hadoop-common-3.3.4-1.oe2203.noarch.rpm</FullProductName>
<FullProductName ProductID="hadoop-tests-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">hadoop-tests-3.3.4-1.oe2203.noarch.rpm</FullProductName>
<FullProductName ProductID="hadoop-client-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">hadoop-client-3.3.4-1.oe2203.noarch.rpm</FullProductName>
<FullProductName ProductID="hadoop-httpfs-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">hadoop-httpfs-3.3.4-1.oe2203.noarch.rpm</FullProductName>
<FullProductName ProductID="hadoop-mapreduce-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">hadoop-mapreduce-3.3.4-1.oe2203.noarch.rpm</FullProductName>
<FullProductName ProductID="hadoop-hdfs-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">hadoop-hdfs-3.3.4-1.oe2203.noarch.rpm</FullProductName>
<FullProductName ProductID="hadoop-yarn-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">hadoop-yarn-3.3.4-1.oe2203.noarch.rpm</FullProductName>
<FullProductName ProductID="hadoop-mapreduce-examples-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">hadoop-mapreduce-examples-3.3.4-1.oe2203.noarch.rpm</FullProductName>
<FullProductName ProductID="hadoop-maven-plugin-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">hadoop-maven-plugin-3.3.4-1.oe2203.noarch.rpm</FullProductName>
</Branch>
<Branch Type="Package Arch" Name="src">
<FullProductName ProductID="hadoop-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">hadoop-3.3.4-1.oe1.src.rpm</FullProductName>
<FullProductName ProductID="hadoop-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">hadoop-3.3.4-1.oe1.src.rpm</FullProductName>
<FullProductName ProductID="hadoop-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">hadoop-3.3.4-1.oe2203.src.rpm</FullProductName>
</Branch>
<Branch Type="Package Arch" Name="x86_64">
<FullProductName ProductID="hadoop-debuginfo-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">hadoop-debuginfo-3.3.4-1.oe1.x86_64.rpm</FullProductName>
<FullProductName ProductID="hadoop-common-native-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">hadoop-common-native-3.3.4-1.oe1.x86_64.rpm</FullProductName>
<FullProductName ProductID="hadoop-yarn-security-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">hadoop-yarn-security-3.3.4-1.oe1.x86_64.rpm</FullProductName>
<FullProductName ProductID="hadoop-debugsource-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">hadoop-debugsource-3.3.4-1.oe1.x86_64.rpm</FullProductName>
<FullProductName ProductID="hadoop-devel-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">hadoop-devel-3.3.4-1.oe1.x86_64.rpm</FullProductName>
<FullProductName ProductID="libhdfs-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">libhdfs-3.3.4-1.oe1.x86_64.rpm</FullProductName>
<FullProductName ProductID="hadoop-debuginfo-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">hadoop-debuginfo-3.3.4-1.oe1.x86_64.rpm</FullProductName>
<FullProductName ProductID="hadoop-devel-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">hadoop-devel-3.3.4-1.oe1.x86_64.rpm</FullProductName>
<FullProductName ProductID="libhdfs-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">libhdfs-3.3.4-1.oe1.x86_64.rpm</FullProductName>
<FullProductName ProductID="hadoop-yarn-security-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">hadoop-yarn-security-3.3.4-1.oe1.x86_64.rpm</FullProductName>
<FullProductName ProductID="hadoop-debugsource-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">hadoop-debugsource-3.3.4-1.oe1.x86_64.rpm</FullProductName>
<FullProductName ProductID="hadoop-common-native-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">hadoop-common-native-3.3.4-1.oe1.x86_64.rpm</FullProductName>
<FullProductName ProductID="hadoop-yarn-security-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">hadoop-yarn-security-3.3.4-1.oe2203.x86_64.rpm</FullProductName>
<FullProductName ProductID="hadoop-common-native-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">hadoop-common-native-3.3.4-1.oe2203.x86_64.rpm</FullProductName>
<FullProductName ProductID="libhdfs-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">libhdfs-3.3.4-1.oe2203.x86_64.rpm</FullProductName>
<FullProductName ProductID="hadoop-debugsource-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">hadoop-debugsource-3.3.4-1.oe2203.x86_64.rpm</FullProductName>
<FullProductName ProductID="hadoop-debuginfo-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">hadoop-debuginfo-3.3.4-1.oe2203.x86_64.rpm</FullProductName>
<FullProductName ProductID="hadoop-devel-3.3.4-1" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">hadoop-devel-3.3.4-1.oe2203.x86_64.rpm</FullProductName>
</Branch>
</ProductTree>
<Vulnerability Ordinal="1" xmlns="http://www.icasi.org/CVRF/schema/vuln/1.1">
<Notes>
<Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. As a result, a TAR entry may create a symlink under the expected extraction directory which points to an external directory. A subsequent TAR entry may extract an arbitrary file into the external directory using the symlink name. This however would be caught by the same targetDirPath check on Unix because of the getCanonicalPath call. However on Windows, getCanonicalPath doesn t resolve symbolic links, which bypasses the check. unpackEntries during TAR extraction follows symbolic links which allows writing outside expected base directory on Windows. This was addressed in Apache Hadoop 3.2.3</Note>
</Notes>
<ReleaseDate>2022-11-11</ReleaseDate>
<CVE>CVE-2022-26612</CVE>
<ProductStatuses>
<Status Type="Fixed">
<ProductID>openEuler-20.03-LTS-SP1</ProductID>
<ProductID>openEuler-20.03-LTS-SP3</ProductID>
<ProductID>openEuler-22.03-LTS</ProductID>
</Status>
</ProductStatuses>
<Threats>
<Threat Type="Impact">
<Description>Critical</Description>
</Threat>
</Threats>
<CVSSScoreSets>
<ScoreSet>
<BaseScore>9.8</BaseScore>
<Vector>AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H</Vector>
</ScoreSet>
</CVSSScoreSets>
<Remediations>
<Remediation Type="Vendor Fix">
<Description>hadoop security update</Description>
<DATE>2022-11-11</DATE>
<URL>https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2092</URL>
</Remediation>
</Remediations>
</Vulnerability>
<Vulnerability Ordinal="2" xmlns="http://www.icasi.org/CVRF/schema/vuln/1.1">
<Notes>
<Note Title="Vulnerability Description" Type="General" Ordinal="2" xml:lang="en">There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may result in a denial of service or arbitrary code execution. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.</Note>
</Notes>
<ReleaseDate>2022-11-11</ReleaseDate>
<CVE>CVE-2021-37404</CVE>
<ProductStatuses>
<Status Type="Fixed">
<ProductID>openEuler-20.03-LTS-SP1</ProductID>
<ProductID>openEuler-20.03-LTS-SP3</ProductID>
<ProductID>openEuler-22.03-LTS</ProductID>
</Status>
</ProductStatuses>
<Threats>
<Threat Type="Impact">
<Description>Critical</Description>
</Threat>
</Threats>
<CVSSScoreSets>
<ScoreSet>
<BaseScore>9.8</BaseScore>
<Vector>AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H</Vector>
</ScoreSet>
</CVSSScoreSets>
<Remediations>
<Remediation Type="Vendor Fix">
<Description>hadoop security update</Description>
<DATE>2022-11-11</DATE>
<URL>https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2092</URL>
</Remediation>
</Remediations>
</Vulnerability>
<Vulnerability Ordinal="3" xmlns="http://www.icasi.org/CVRF/schema/vuln/1.1">
<Notes>
<Note Title="Vulnerability Description" Type="General" Ordinal="3" xml:lang="en">Apache Hadoop s FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It has been used in Hadoop 2.x for yarn localization, which does enable remote code execution. It is used in Apache Spark, from the SQL command ADD ARCHIVE. As the ADD ARCHIVE command adds new binaries to the classpath, being able to execute shell scripts does not confer new permissions to the caller. SPARK-38305. Check existence of file before untarring/zipping , which is included in 3.3.0, 3.1.4, 3.2.2, prevents shell commands being executed, regardless of which version of the hadoop libraries are in use. Users should upgrade to Apache Hadoop 2.10.2, 3.2.4, 3.3.3 or upper (including HADOOP-18136).</Note>
</Notes>
<ReleaseDate>2022-11-11</ReleaseDate>
<CVE>CVE-2022-25168</CVE>
<ProductStatuses>
<Status Type="Fixed">
<ProductID>openEuler-20.03-LTS-SP1</ProductID>
<ProductID>openEuler-20.03-LTS-SP3</ProductID>
<ProductID>openEuler-22.03-LTS</ProductID>
</Status>
</ProductStatuses>
<Threats>
<Threat Type="Impact">
<Description>Critical</Description>
</Threat>
</Threats>
<CVSSScoreSets>
<ScoreSet>
<BaseScore>9.8</BaseScore>
<Vector>AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H</Vector>
</ScoreSet>
</CVSSScoreSets>
<Remediations>
<Remediation Type="Vendor Fix">
<Description>hadoop security update</Description>
<DATE>2022-11-11</DATE>
<URL>https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2092</URL>
</Remediation>
</Remediations>
</Vulnerability>
</cvrfdoc>
Reference in New Issue View Git Blame Copy Permalink