apache/hadoop · Security
Apache Hadoop heap overflow before v2.10.2, v3.2.3, v3.3.2
- GHSA ID
- GHSA-rmpj-7c96-mrg8
- CVE ID
- CVE-2021-37404
- Severity
- critical
- Published
- Updated
- CVSS
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may result in a denial of service or arbitrary code execution. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.
CWEs
- CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
- CWE-131 · Incorrect Calculation of Buffer Size
- CWE-787 · Out-of-bounds Write