Bug 2127281 (CVE-2021-25642)

Summary: CVE-2021-25642 Hadoop: YARN remote code execution in ZKConfigurationStore of capacity scheduler
Product: [Other] Security Response Reporter: Chess Hazlett <chazlett>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: aileenc, balejosg, chazlett, fmongiar, gmalinko, janstey, jcantril, jnethert, jochrist, jpavlik, jpoth, jwon, ldemasi, pantinor, pdelbell, peholase, periklis, pjindal
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Hadoop 2.10.2, Hadoop 3.2.4, Hadoop 3.3.4 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2022-11-27 14:27:42 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2122666    

Description Chess Hazlett 2022-09-15 20:03:06 UTC 
ZKConfigurationStore which is optionally used by CapacityScheduler of Apache Hadoop YARN deserializes data obtained from ZooKeeper without validation. An attacker having access to ZooKeeper can run arbitrary commands as YARN user by exploiting this.
Comment 1 Product Security DevOps Team 2022-11-27 14:27:40 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-25642