CVE-2020-35451 Oozie local privilege escalation

Medium 4.7 Published 9 Mar 2021 Updated 13 Feb 2025

A race condition in Apache Oozie allows attackers to replace sharelib files during creation, leading to local privilege escalation and potential code execution.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-35451?

CVE-2020-35451 is a medium-severity vulnerability in Apache Oozie, published on 9 Mar 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

There is a race condition in OozieSharelibCLI in Apache Oozie before version 5.2.1 which allows a malicious attacker to replace the files in Oozie's sharelib during it's creation.

Weakness: CWE-362, CWE-377

Which versions are affected by CVE-2020-35451?

It affects 1 product.

Products include Apache Oozie.

How do I fix CVE-2020-35451?

No fix has been published for CVE-2020-35451 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-35451 being exploited?

There is no known exploitation of CVE-2020-35451 in the wild and no public exploit code.

Sources

Also known as GHSA-9rqf-w99j-7c4r.