Moole Vulnerability Database

Find real vulnerabilities before they ship

Critical

CVE-2016-3086

The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for credential store provider used by the NodeManager to YARN Applications.

VectorNETWORK

PublishedSep 05, 2017, 13:29

Published Bysecurity@apache.org

Base Score

Score9.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.apache.hadoop:hadoop-yarn-server-nodemanager(Maven)2.6.02.6.5N/A

org.apache.hadoop:hadoop-yarn-server-nodemanager(Maven)2.7.02.7.3N/A

References

http://mail-archives.apache.org/mod_mbox/hadoop-general/201701.mbox/%3C0ed32746-5a53-9051-5877-2b1abd88beb6%40apache.org%3E
http://www.securityfocus.com/bid/95335

Weakness Type

CWE-200

CVSS Metrics

Base Score

9.8

Vector String

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base SeverityCritical

Version

3.0

Attack Vector (AV)

NETWORK