CVE-2021-37404
Critical
Description
There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may result in a denial of service or arbitrary code execution. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Apache Hadoop
PublishedJun 13, 2022
First seenJun 13, 2022
Weakness typeCWE-787Out-of-bounds write
How to fix
Update
- apache hadoop2.10.2, 3.2.3, 3.3.2 or later
- org.apache.hadoop:hadoop-common3.3.2, 3.2.3, 2.10.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache hadoop | 2.9.0 ≤ v < 2.10.2, 3.0.0 ≤ v ≤ 3.1.4, 3.2.0 ≤ v < 3.2.3, 3.3.0 ≤ v < 3.3.2 | 2.10.2, 3.2.3, 3.3.2 |
| org.apache.hadoop:hadoop-commonMaven | 3.3.0 ≤ v < 3.3.2, 3.0.0 ≤ v < 3.2.3, v < 2.10.2 | 3.3.2, 3.2.3, 2.10.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.