Bug 2097421 (CVE-2021-37404)

Summary:	CVE-2021-37404 hadoop-hdfs: Heap buffer overflow in Apache Hadoop libhdfs
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aileenc, bmontgom, chazlett, eparis, gmalinko, janstey, jburrell, jochrist, jokerman, jwon, kaycoth, nstielau, pdelbell, sponnaga, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Apache Hadoop 2.10.2, Apache Hadoop 3.2.3, Apache Hadoop 3.3.2	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in Apache Hadoop. Opening a file path provided by a user without validation may result in a denial of service or arbitrary code execution.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2097466, 2097467, 2097468
Bug Blocks:	2097422

Description Pedro Sampaio 2022-06-15 16:17:52 UTC

There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may result in a denial of service or arbitrary code execution. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.

References:

https://lists.apache.org/thread/2h56ztcj3ojc66qzf1nno88vjw9vd4wo