In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without proper verification. References: https://lists.apache.org/thread.html/r513758942356ccd0d14538ba18a09903fc72716d74be1cb727ea91ff%40%3Cgeneral.hadoop.apache.org%3E https://lists.apache.org/thread.html/r79323adac584edab99fd5e4b52a013844b784a5d4b600da0662b33d6@%3Ccommits.druid.apache.org%3E https://lists.apache.org/thread.html/r941e9be04efe0f455d20aeac88516c0848decd7e7b1d93d5687060f4@%3Ccommits.druid.apache.org%3E https://lists.apache.org/thread.html/rc0057ebf32b646ab47f7f5744a8948332e015c39044cbb9d87ea76cd@%3Ccommits.druid.apache.org%3E https://lists.apache.org/thread.html/rca4516b00b55b347905df45e5d0432186248223f30497db87aba8710@%3Cannounce.apache.org%3E
This vulnerability is out of security support scope for the following products: * Red Hat JBoss Data Virtualization 6 Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.
I couldn't find any evidence of using WebHDFS client in. OSD clusters, still checking
Upstream commit: https://github.com/apache/hadoop/commit/81d8a887b0406380e469c76ed2e41022a6372dd7
External References: https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEHADOOP-1065272 https://hadoop.apache.org/cve_list.html
Marking Red Hat JBoss Fuse 6, Red Hat Fuse 7 and Red Hat Integration Camel K as being affected but at a low impact, although all products distribute and use artifacts in the affected range ie. org.apache.hadoop:hadoop-hdfs:jar:* as part of camel-hdfs2 and camel-hdfs neither component uses the vulnerable WebHDFS client functionality and webhdfs URIs are not supported.
Statement: While OpenShift Container Platform (OCP) does package a vulnerable version of hadoop-hdfs-client in the hadoop and hive containers, the HDFS storage back-end is not enabled by default and is largely undocumented/unsupported. However, as it still can be enabled by using the configuration option `unsupportedFeatures.enabledHDFS`, the vulnerability has been rated Moderate for OCP. In OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack, ship the vulnerable version of hadoop package. Since the release of OCP 4.6, the Metering product has been deprecated [1], hence the affected components are marked as wontfix. This may be fixed in the future. [1] https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html#ocp-4-6-metering-operator-deprecated
This issue has been addressed in the following products: RHINT Camel-Q 2.7 Via RHSA-2022:5606 https://access.redhat.com/errata/RHSA-2022:5606
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-9492
This issue has been addressed in the following products: RHAF Camel-K 1.8 Via RHSA-2022:6407 https://access.redhat.com/errata/RHSA-2022:6407