Bug 1925237 (CVE-2020-9492)
| Summary: | CVE-2020-9492 hadoop: WebHDFS client might send SPNEGO authorization header | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Michael Kaplan <mkaplan> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | aileenc, aos-bugs, asoldano, atangrin, bbaranow, bmaxwell, bmontgom, brian.stansberry, cdewolf, chazlett, darran.lofthouse, dkreling, dosoudil, dramseur, drieden, eleandro, eparis, fjuma, ganandan, gmalinko, hbraun, iweiss, janstey, jburrell, jhunter, jnethert, jochrist, jpallich, jperkins, jwon, kmitts, krathod, kwills, lgao, mgala, msochure, msvehla, nstielau, nwallace, pantinor, pjindal, pmackay, rguimara, rstancel, rsvoboda, sd-operator-metering, smaestri, sponnaga, tflannag, tom.jenkinson, yborgess |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | hadoop 3.2.2, hadoop 3.1.4, hadoop 2.10.1 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in Apache hadoop. The WebHDFS client can send a SPNEGO authorization header to a remote URL without proper verification which could lead to an access restriction bypass. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-08-30 09:33:27 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1926034, 1926035, 1926036, 1926037, 1926038, 1926039, 1926040, 1926041 | ||
| Bug Blocks: | 1925238 | ||
|
Description
Michael Kaplan
2021-02-04 16:25:28 UTC
This vulnerability is out of security support scope for the following products: * Red Hat JBoss Data Virtualization 6 Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details. I couldn't find any evidence of using WebHDFS client in. OSD clusters, still checking External References: https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEHADOOP-1065272 https://hadoop.apache.org/cve_list.html Marking Red Hat JBoss Fuse 6, Red Hat Fuse 7 and Red Hat Integration Camel K as being affected but at a low impact, although all products distribute and use artifacts in the affected range ie. org.apache.hadoop:hadoop-hdfs:jar:* as part of camel-hdfs2 and camel-hdfs neither component uses the vulnerable WebHDFS client functionality and webhdfs URIs are not supported. Statement: While OpenShift Container Platform (OCP) does package a vulnerable version of hadoop-hdfs-client in the hadoop and hive containers, the HDFS storage back-end is not enabled by default and is largely undocumented/unsupported. However, as it still can be enabled by using the configuration option `unsupportedFeatures.enabledHDFS`, the vulnerability has been rated Moderate for OCP. In OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack, ship the vulnerable version of hadoop package. Since the release of OCP 4.6, the Metering product has been deprecated [1], hence the affected components are marked as wontfix. This may be fixed in the future. [1] https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html#ocp-4-6-metering-operator-deprecated This issue has been addressed in the following products: RHINT Camel-Q 2.7 Via RHSA-2022:5606 https://access.redhat.com/errata/RHSA-2022:5606 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-9492 This issue has been addressed in the following products: RHAF Camel-K 1.8 Via RHSA-2022:6407 https://access.redhat.com/errata/RHSA-2022:6407 |