search

jgeraigery / hadoop-555665675

Apache Hadoop
https://hadoop.apache.org/
Apache License 2.0
0 stars 0 forks source link

hadoop-common-3.3.1.jar: 2 vulnerabilities (highest severity is: 9.8) #118

Open mend-for-github-com[bot] opened 6 months ago

mend-for-github-com[bot] commented 6 months ago
Vulnerable Library - hadoop-common-3.3.1.jar

Apache Hadoop Common

Library home page: https://www.apache.org

Path to dependency file: /hadoop-common-project/hadoop-registry/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/hadoop/hadoop-common/3.3.1/hadoop-common-3.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/hadoop/hadoop-common/3.3.1/hadoop-common-3.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/hadoop/hadoop-common/3.3.1/hadoop-common-3.3.1.jar

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (hadoop-common version) Remediation Possible** Reachability
CVE-2022-25168 Critical 9.8 Not Defined 0.6% hadoop-common-3.3.1.jar Direct 3.3.3 ✅
CVE-2024-6763 Low 3.7 Not Defined 0.1% jetty-http-9.4.55.v20240627.jar Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-25168 ### Vulnerable Library - hadoop-common-3.3.1.jar

Apache Hadoop Common

Library home page: https://www.apache.org

Path to dependency file: /hadoop-common-project/hadoop-registry/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/hadoop/hadoop-common/3.3.1/hadoop-common-3.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/hadoop/hadoop-common/3.3.1/hadoop-common-3.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/hadoop/hadoop-common/3.3.1/hadoop-common-3.3.1.jar

Dependency Hierarchy: - :x: **hadoop-common-3.3.1.jar** (Vulnerable Library)

Found in base branch: hubspot-3.3

### Vulnerability Details

Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It has been used in Hadoop 2.x for yarn localization, which does enable remote code execution. It is used in Apache Spark, from the SQL command ADD ARCHIVE. As the ADD ARCHIVE command adds new binaries to the classpath, being able to execute shell scripts does not confer new permissions to the caller. SPARK-38305. "Check existence of file before untarring/zipping", which is included in 3.3.0, 3.1.4, 3.2.2, prevents shell commands being executed, regardless of which version of the hadoop libraries are in use. Users should upgrade to Apache Hadoop 2.10.2, 3.2.4, 3.3.3 or upper (including HADOOP-18136).

Publish Date: 2022-08-04

URL: CVE-2022-25168

### Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.6%

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://lists.apache.org/thread/mxqnb39jfrwgs3j6phwvlrfq4mlox130

Release Date: 2022-08-04

Fix Resolution: 3.3.3

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2024-6763 ### Vulnerable Library - jetty-http-9.4.55.v20240627.jar

Library home page: https://webtide.com

Path to dependency file: /hadoop-common-project/hadoop-common/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-http/9.4.55.v20240627/jetty-http-9.4.55.v20240627.jar,/home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-http/9.4.55.v20240627/jetty-http-9.4.55.v20240627.jar,/home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-http/9.4.55.v20240627/jetty-http-9.4.55.v20240627.jar,/home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-http/9.4.55.v20240627/jetty-http-9.4.55.v20240627.jar,/home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-http/9.4.55.v20240627/jetty-http-9.4.55.v20240627.jar

Dependency Hierarchy: - hadoop-common-3.3.1.jar (Root Library) - jetty-server-9.4.55.v20240627.jar - :x: **jetty-http-9.4.55.v20240627.jar** (Vulnerable Library)

Found in base branch: hubspot-3.3

### Vulnerability Details

Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing. The HttpURI class does insufficient validation on the authority segment of a URI. However the behaviour of HttpURI differs from the common browsers in how it handles a URI that would be considered invalid if fully validated against the RRC. Specifically HttpURI and the browser may differ on the value of the host extracted from an invalid URI and thus a combination of Jetty and a vulnerable browser may be vulnerable to a open redirect attack or to a SSRF attack if the URI is used after passing validation checks.

Publish Date: 2024-10-14

URL: CVE-2024-6763

### Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

### CVSS 3 Score Details (3.7)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/jetty/jetty.project/security/advisories/GHSA-qh8g-58pp-2wxh

Release Date: 2024-10-14

Fix Resolution: org.eclipse.jetty:jetty-http:12.0.12;org.eclipse.jetty:jetty-server:12.0.12

:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.

mend-for-github-com[bot] commented 5 months ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

mend-for-github-com[bot] commented 3 months ago

:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.