Read the docs
TI-2013-01958 Aliases CVE-2013-2192GHSA-pxv5-5vmp-3jj4

The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before…

Priority LOW 18CWE-287Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
Partial · Partial · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-287.

Summary

The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos security features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information by forcing a downgrade to simple authentication.

Why it matters now

EPSS 0.01069 65th percentileScored 2026-11-07
Fix Fixed org.apache.hadoop:hadoop-common (Maven): 2.0.6-alpha, 0.23.9Red Hat: 3 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.apache.hadoop:hadoop-common (Maven)2.0.0 to before 2.0.6-alpha2.0.6-alphaPatch availableGHSA-pxv5-5vmp-3jj4
—org.apache.hadoop:hadoop-common (Maven)0.23.0 to before 0.23.90.23.9Patch availableGHSA-pxv5-5vmp-3jj4
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.apache.hadoop:hadoop-common (Maven) Vendor— Affected 2.0.0 to before 2.0.6-alpha Fixed in 2.0.6-alpha Patch available GHSA-pxv5-5vmp-3jj4
  • org.apache.hadoop:hadoop-common (Maven) Vendor— Affected 0.23.0 to before 0.23.9 Fixed in 0.23.9 Patch available GHSA-pxv5-5vmp-3jj4

CPE configurations NVD · 23

CPEVersionsRoleVendor
cpe:2.3:a:apache:hadoop:0.23.0:*:*:*:*:*:*:*0.23.0VulnerableApache
cpe:2.3:a:apache:hadoop:0.23.1:*:*:*:*:*:*:*0.23.1VulnerableApache
cpe:2.3:a:apache:hadoop:0.23.3:*:*:*:*:*:*:*0.23.3VulnerableApache
cpe:2.3:a:apache:hadoop:0.23.4:*:*:*:*:*:*:*0.23.4VulnerableApache
cpe:2.3:a:apache:hadoop:0.23.5:*:*:*:*:*:*:*0.23.5VulnerableApache
cpe:2.3:a:apache:hadoop:0.23.6:*:*:*:*:*:*:*0.23.6VulnerableApache
cpe:2.3:a:apache:hadoop:0.23.7:*:*:*:*:*:*:*0.23.7VulnerableApache
cpe:2.3:a:apache:hadoop:0.23.8:*:*:*:*:*:*:*0.23.8VulnerableApache
cpe:2.3:a:apache:hadoop:1.0.0:*:*:*:*:*:*:*1.0.0VulnerableApache
cpe:2.3:a:apache:hadoop:1.0.1:*:*:*:*:*:*:*1.0.1VulnerableApache
  • cpe:2.3:a:apache:hadoop:0.23.0:*:*:*:*:*:*:* Versions 0.23.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:hadoop:0.23.1:*:*:*:*:*:*:* Versions 0.23.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:hadoop:0.23.3:*:*:*:*:*:*:* Versions 0.23.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:hadoop:0.23.4:*:*:*:*:*:*:* Versions 0.23.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:hadoop:0.23.5:*:*:*:*:*:*:* Versions 0.23.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:hadoop:0.23.6:*:*:*:*:*:*:* Versions 0.23.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:hadoop:0.23.7:*:*:*:*:*:*:* Versions 0.23.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:hadoop:0.23.8:*:*:*:*:*:*:* Versions 0.23.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:hadoop:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:hadoop:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·Apache
Show 13 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:hadoop:1.0.2:*:*:*:*:*:*:*1.0.2VulnerableApache
cpe:2.3:a:apache:hadoop:1.0.3:*:*:*:*:*:*:*1.0.3VulnerableApache
cpe:2.3:a:apache:hadoop:1.0.4:*:*:*:*:*:*:*1.0.4VulnerableApache
cpe:2.3:a:apache:hadoop:1.1.0:*:*:*:*:*:*:*1.1.0VulnerableApache
cpe:2.3:a:apache:hadoop:1.1.1:*:*:*:*:*:*:*1.1.1VulnerableApache
cpe:2.3:a:apache:hadoop:1.1.2:*:*:*:*:*:*:*1.1.2VulnerableApache
cpe:2.3:a:apache:hadoop:1.2.0:*:*:*:*:*:*:*1.2.0VulnerableApache
cpe:2.3:a:apache:hadoop:2.0.0:alpha:*:*:*:*:*:*2.0.0 alphaVulnerableApache
cpe:2.3:a:apache:hadoop:2.0.1:alpha:*:*:*:*:*:*2.0.1 alphaVulnerableApache
cpe:2.3:a:apache:hadoop:2.0.2:alpha:*:*:*:*:*:*2.0.2 alphaVulnerableApache
cpe:2.3:a:apache:hadoop:2.0.3:alpha:*:*:*:*:*:*2.0.3 alphaVulnerableApache
cpe:2.3:a:apache:hadoop:2.0.4:alpha:*:*:*:*:*:*2.0.4 alphaVulnerableApache
cpe:2.3:a:apache:hadoop:2.0.5:alpha:*:*:*:*:*:*2.0.5 alphaVulnerableApache
  • cpe:2.3:a:apache:hadoop:1.0.2:*:*:*:*:*:*:* Versions 1.0.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:hadoop:1.0.3:*:*:*:*:*:*:* Versions 1.0.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:hadoop:1.0.4:*:*:*:*:*:*:* Versions 1.0.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:hadoop:1.1.0:*:*:*:*:*:*:* Versions 1.1.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:hadoop:1.1.1:*:*:*:*:*:*:* Versions 1.1.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:hadoop:1.1.2:*:*:*:*:*:*:* Versions 1.1.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:hadoop:1.2.0:*:*:*:*:*:*:* Versions 1.2.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:hadoop:2.0.0:alpha:*:*:*:*:*:* Versions 2.0.0 alpha Vulnerable ·Apache
  • cpe:2.3:a:apache:hadoop:2.0.1:alpha:*:*:*:*:*:* Versions 2.0.1 alpha Vulnerable ·Apache
  • cpe:2.3:a:apache:hadoop:2.0.2:alpha:*:*:*:*:*:* Versions 2.0.2 alpha Vulnerable ·Apache
  • cpe:2.3:a:apache:hadoop:2.0.3:alpha:*:*:*:*:*:* Versions 2.0.3 alpha Vulnerable ·Apache
  • cpe:2.3:a:apache:hadoop:2.0.4:alpha:*:*:*:*:*:* Versions 2.0.4 alpha Vulnerable ·Apache
  • cpe:2.3:a:apache:hadoop:2.0.5:alpha:*:*:*:*:*:* Versions 2.0.5 alpha Vulnerable ·Apache

Remediation

  • Fix · GHSA-pxv5-5vmp-3jj4 org.apache.hadoop:hadoop-common (Maven) Fixed in 2.0.6-alpha Advisory →
  • Fix · GHSA-pxv5-5vmp-3jj4 org.apache.hadoop:hadoop-common (Maven) Fixed in 0.23.9 Advisory →

Red Hat 3 advisories

  • RHSA-2014:0400 Released 2014-04-14 · Red Hat rating Moderate
    Red Hat JBoss Fuse 6.1.0 update
    • Red Hat JBoss Fuse 6.1
  • RHSA-2014:0401 Released 2014-04-14 · Red Hat rating Moderate
    Red Hat JBoss A-MQ 6.1.0 update
    • Red Hat JBoss A-MQ 6.1
  • RHSA-2014:0037 Released 2014-01-21 · Red Hat rating Moderate
    jasperreports-server-pro security, bug fix, and enhancement update
    • RHEV-M 3.3 jasperreports-server-pro-5.5.0-4.el6ev

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
RHEV-M 3.3Fixed RHSA-2014:0037
Red Hat JBoss A-MQ 6.1Fixed RHSA-2014:0401
Red Hat JBoss Fuse 6.1Fixed RHSA-2014:0400
Not affected: 1 product
  • OpenShift Enterprise 1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-2192
  2. 2026-10-03 Alias added: GHSA-pxv5-5vmp-3jj4

References

Advisory 3

Other 2

  • TI-2019-12818 Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while… CVSS 3.1CRITICAL 9.8
  • TI-2022-09898 Arbitrary file write in FileUtil#unpackEntries on Windows CVSS 3.1CRITICAL 9.8
  • TI-2022-08881 Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTar CVSS 3.1CRITICAL 9.8
  • TI-2021-15353 Heap buffer overflow in libhdfs native library CVSS 3.1CRITICAL 9.8
  • TI-2018-05786 Path traversal in Apache Hadoop CVSS 3.0HIGH 8.8
  • TI-2017-11489 Information disclosure in Apache Hadoop CVSS 3.0CRITICAL 9.8
See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences