CVE-2018-11766 Arbitrary Command Execution in Hadoop
An attacker with yarn user access can escalate privileges to root and execute arbitrary commands in Apache Hadoop.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-11766?
CVE-2018-11766 is a high-severity vulnerability in Apache Hadoop, published on 27 Nov 2018. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In Apache Hadoop 2.7.4 to 2.7.6, the security fix for CVE-2016-6811 is incomplete. A user who can escalate to yarn user can possibly run arbitrary commands as root user.
Which versions are affected by CVE-2018-11766?
2 open source packages ship an affected version, including org.apache.hadoop:hadoop-main. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.hadoop:hadoop-main Maven | From 2.7.4 | 2.7.7 |
org.apache.hadoop:hadoop-main Maven | From 2.7.4 | 2.7.7 |
Products include Apache Hadoop.
How do I fix CVE-2018-11766?
Upgrade org.apache.hadoop:hadoop-main to 2.7.7 or later.
Is CVE-2018-11766 being exploited?
There is no known exploitation of CVE-2018-11766 in the wild and no public exploit code.
Other vulnerabilities in Apache Hadoop
- CVE-2022-25168 Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTar
- CVE-2021-37404 Heap buffer overflow in libhdfs native library
- CVE-2022-26612 Arbitrary file write in FileUtil#unpackEntries on Windows
- CVE-2019-17195 Improper Check for Unusual or Exceptional Conditions in Connect2id Nimbus JOSE+JWT
- CVE-2017-15718 Exposure of Sensitive Information in Hadoop
Sources
Also known as GHSA-rqj9-cq6j-958r.