Incorrect authorization in Apache Hadoop
Priority MEDIUM 45CWE-863Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass, Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 2 fixed, 4 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863 and CWE-269.
Summary
In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without proper verification.
Why it matters now
EPSS 0.04493 91st percentileScored 2026-11-07
Fix Partial org.apache.hadoop:hadoop-common (Maven): 3.2.2, 3.1.4, 2.10.1Red Hat: 2 advisoriesRed Hat: 2 fixed, 4 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Apache Hadoop | Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, 2.0.0-alpha to 2.10.0 | — | No fix listed | CNA |
| — | org.apache.hadoop:hadoop-common (Maven) | 3.2.0 to before 3.2.2 | 3.2.2 | Patch available | GHSA-f8vc-wfc8-hxqh |
| — | org.apache.hadoop:hadoop-common (Maven) | 3.0.0 to before 3.1.4 | 3.1.4 | Patch available | GHSA-f8vc-wfc8-hxqh |
| — | org.apache.hadoop:hadoop-common (Maven) | 2.0.0 to before 2.10.1 | 2.10.1 | Patch available | GHSA-f8vc-wfc8-hxqh |
- Apache Hadoop Vendor— Affected Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, 2.0.0-alpha to 2.10.0 Fixed in — No fix listed CNA
- org.apache.hadoop:hadoop-common (Maven) Vendor— Affected 3.2.0 to before 3.2.2 Fixed in 3.2.2 Patch available GHSA-f8vc-wfc8-hxqh
- org.apache.hadoop:hadoop-common (Maven) Vendor— Affected 3.0.0 to before 3.1.4 Fixed in 3.1.4 Patch available GHSA-f8vc-wfc8-hxqh
- org.apache.hadoop:hadoop-common (Maven) Vendor— Affected 2.0.0 to before 2.10.1 Fixed in 2.10.1 Patch available GHSA-f8vc-wfc8-hxqh
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:* | 2.0.0 – 2.10.0; 3.0.0 – 3.1.3; 3.2.0 – 3.2.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:solr:8.6.0:*:*:*:*:*:*:* | 8.6.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:solr:8.6.2:*:*:*:*:*:*:* | 8.6.2 | Vulnerable | Apache |
| cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:* | 8.0.8.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:* | 8.0.8.3.0 | Vulnerable | Oracle |
- cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:* Versions 2.0.0 – 2.10.0; 3.0.0 – 3.1.3; 3.2.0 – 3.2.1 Vulnerable ·Apache
- cpe:2.3:a:apache:solr:8.6.0:*:*:*:*:*:*:* Versions 8.6.0 Vulnerable ·Apache
- cpe:2.3:a:apache:solr:8.6.2:*:*:*:*:*:*:* Versions 8.6.2 Vulnerable ·Apache
- cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:* Versions 8.0.8.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:* Versions 8.0.8.3.0 Vulnerable ·Oracle
Remediation
- Fix · GHSA-f8vc-wfc8-hxqh org.apache.hadoop:hadoop-common (Maven) Fixed in 3.2.2 Advisory →
- Fix · GHSA-f8vc-wfc8-hxqh org.apache.hadoop:hadoop-common (Maven) Fixed in 3.1.4 Advisory →
- Fix · GHSA-f8vc-wfc8-hxqh org.apache.hadoop:hadoop-common (Maven) Fixed in 2.10.1 Advisory →
Red Hat 2 advisories
- RHSA-2022:6407 Released 2022-09-09 · Red Hat rating ModerateRed Hat Integration Camel-K 1.8 security update
- RHAF Camel-K 1.8
- RHSA-2022:5606 Released 2022-07-19 · Red Hat rating ModerateRed Hat Integration Camel Extensions for Quarkus 2.7 security update
- RHINT Camel-Q 2.7
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Fuse 7 | Affected | No fix yet: Fix deferred |
| Red Hat Integration Camel Quarkus 1 | Affected | No fix yet |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| RHAF Camel-K 1.8 | Fixed | RHSA-2022:6407 |
| RHINT Camel-Q 2.7 | Fixed | RHSA-2022:5606 |
Not affected: 1 product
- Red Hat JBoss Enterprise Application Platform 7
Timeline
- 2026-10-02 Threatist record created from CVE-2020-9492
- 2026-10-03 Alias added: GHSA-f8vc-wfc8-hxqh
References
Advisory 3
Other 29
- [announce] 20210125 [CVE-2020-9492] Apache Hadoop Potential privilege escalation
- [druid-commits] 20210203 [GitHub] [druid] jihoonson opened a new pull request #10847: Suppress CVE-2020-9492 for hadoop-mapreduce-client-core
- [druid-commits] 20210203 [GitHub] [druid] jihoonson commented on pull request #10847: Suppress CVE-2020-9492 for hadoop-mapreduce-client-core
- [druid-commits] 20210203 [GitHub] [druid] jihoonson merged pull request #10847: Suppress CVE-2020-9492 for hadoop-mapreduce-client-core
- [druid-commits] 20210225 [GitHub] [druid] liangrui1988 commented on pull request #10847: Suppress CVE-2020-9492 for hadoop-mapreduce-client-core
- [solr-issues] 20210419 [jira] [Updated] (SOLR-15355) CVE-2020-9492: Upgrade hadoop-hdfs-client to 3.2.2
- [solr-issues] 20210419 [jira] [Created] (SOLR-15355) CVE-2020-9492: Upgrade hadoop-hdfs-client to 3.2.2
- [solr-issues] 20210623 [jira] [Updated] (SOLR-15355) CVE-2020-9492: Upgrade hadoop-hdfs-client to 3.2.2
- [solr-issues] 20210702 [jira] [Commented] (SOLR-15355) CVE-2020-9492: Upgrade hadoop-hdfs-client to 3.2.2
- [solr-issues] 20211016 [jira] [Commented] (SOLR-15355) CVE-2020-9492: Upgrade hadoop-hdfs-client to 3.2.2
- [solr-issues] 20211015 [jira] [Resolved] (SOLR-15355) CVE-2020-9492: Upgrade hadoop-hdfs-client to 3.2.2
- [solr-issues] 20211020 [jira] [Commented] (SOLR-15355) CVE-2020-9492: Upgrade hadoop-hdfs-client to 3.2.2
- [solr-issues] 20211022 [jira] [Commented] (SOLR-15355) CVE-2020-9492: Upgrade hadoop-hdfs-client to 3.2.2
- https://github.com/apache/hadoop/commit/ca65409836d2949e9a9408d40bec0177b414cd5d
- https://security.netapp.com/advisory/ntap-20210304-0001
- https://lists.apache.org/thread.html/re4129c6b9e0410848bbd3761187ce9c19bc1cd491037b253007df99e@%3Cissues.solr.apache.org%3E
- https://lists.apache.org/thread.html/rca4516b00b55b347905df45e5d0432186248223f30497db87aba8710@%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/rc0057ebf32b646ab47f7f5744a8948332e015c39044cbb9d87ea76cd@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/rb12afaa421d483863c4175e42e5dbd0673917a3cff73f3fca4f8275f@%3Cissues.solr.apache.org%3E
- https://lists.apache.org/thread.html/r941e9be04efe0f455d20aeac88516c0848decd7e7b1d93d5687060f4@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r9328eb49305e4cacc80e182bfd8a2efd8e640d940e24f5bfd7d5cb26@%3Cissues.solr.apache.org%3E
- https://lists.apache.org/thread.html/r79323adac584edab99fd5e4b52a013844b784a5d4b600da0662b33d6@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r79201a209df9a4e7f761e537434131b4e39eabec4369a7d668904df4@%3Cissues.solr.apache.org%3E
- https://lists.apache.org/thread.html/r6c2fa7949738e9d39606f1d7cd890c93a2633e3357c9aeaf886ea9a6@%3Cissues.solr.apache.org%3E
- https://lists.apache.org/thread.html/r6341f2a468ced8872a71997aa1786ce036242413484f0fa68dc9ca02@%3Cissues.solr.apache.org%3E
- https://lists.apache.org/thread.html/r4a57de5215494c35c8304cf114be75d42df7abc6c0c54bf163c3e370@%3Cissues.solr.apache.org%3E
- https://lists.apache.org/thread.html/r49c9ab444ab1107c6a8be8a0d66602dec32a16d96c2631fec8d309fb@%3Cissues.solr.apache.org%3E
- https://lists.apache.org/thread.html/r0a534f1cde7555f7208e9f9b791c1ab396d215eaaef283b3a9153429@%3Ccommits.druid.apache.org%3E
- https://github.com/apache/hadoop
Sources
- CVE-2020-9492 · CVE Program
- CVE-2020-9492 · NVD
- FIRST EPSS
- GHSA-f8vc-wfc8-hxqh · GitHub Advisory Database · CC BY 4.0
- CVE-2020-9492 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences