Read the docs
TI-2017-05305 Aliases CVE-2017-7669GHSA-h24p-qwf4-84q8

Improper input validation in Apache Hadoop

Priority LOW 36CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.

Summary

In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root.

Why it matters now

EPSS 0.01795 78th percentileScored 2026-11-07
Fix Fixed org.apache.hadoop:hadoop-common (Maven): 2.8.1, 3.0.0-alpha3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Hadoop2.8.0; 3.0.0-alpha1 and 3.0.0-alpha2—No fix listedCNA
—org.apache.hadoop:hadoop-common (Maven)before 2.8.12.8.1Patch availableGHSA-h24p-qwf4-84q8
—org.apache.hadoop:hadoop-common (Maven)3.0.0-alpha1 to before 3.0.0-alpha33.0.0-alpha3Patch availableGHSA-h24p-qwf4-84q8
  • Apache Hadoop VendorApache Affected 2.8.0; 3.0.0-alpha1 and 3.0.0-alpha2 Fixed in — No fix listed CNA
  • org.apache.hadoop:hadoop-common (Maven) Vendor— Affected before 2.8.1 Fixed in 2.8.1 Patch available GHSA-h24p-qwf4-84q8
  • org.apache.hadoop:hadoop-common (Maven) Vendor— Affected 3.0.0-alpha1 to before 3.0.0-alpha3 Fixed in 3.0.0-alpha3 Patch available GHSA-h24p-qwf4-84q8

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:apache:hadoop:2.8.0:*:*:*:*:*:*:*2.8.0VulnerableApache
cpe:2.3:a:apache:hadoop:3.0.0:alpha1:*:*:*:*:*:*3.0.0 alpha1VulnerableApache
cpe:2.3:a:apache:hadoop:3.0.0:alpha2:*:*:*:*:*:*3.0.0 alpha2VulnerableApache
  • cpe:2.3:a:apache:hadoop:2.8.0:*:*:*:*:*:*:* Versions 2.8.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:hadoop:3.0.0:alpha1:*:*:*:*:*:* Versions 3.0.0 alpha1 Vulnerable ·Apache
  • cpe:2.3:a:apache:hadoop:3.0.0:alpha2:*:*:*:*:*:* Versions 3.0.0 alpha2 Vulnerable ·Apache

Remediation

  • Fix · GHSA-h24p-qwf4-84q8 org.apache.hadoop:hadoop-common (Maven) Fixed in 2.8.1 Advisory →
  • Fix · GHSA-h24p-qwf4-84q8 org.apache.hadoop:hadoop-common (Maven) Fixed in 3.0.0-alpha3 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-7669
  2. 2026-10-03 Alias added: GHSA-h24p-qwf4-84q8

References

Advisory 2

  • TI-2019-12818 Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while… CVSS 3.1CRITICAL 9.8
  • TI-2022-09898 Arbitrary file write in FileUtil#unpackEntries on Windows CVSS 3.1CRITICAL 9.8
  • TI-2022-08881 Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTar CVSS 3.1CRITICAL 9.8
  • TI-2021-15353 Heap buffer overflow in libhdfs native library CVSS 3.1CRITICAL 9.8
  • TI-2018-05786 Path traversal in Apache Hadoop CVSS 3.0HIGH 8.8
  • TI-2017-11489 Information disclosure in Apache Hadoop CVSS 3.0CRITICAL 9.8
See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences