-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability fundamentally stems from improper authentication in Kerberos/MapReduce components. The LinuxTaskController (or equivalent) is directly responsible for enforcing user permissions during task execution - a failure here would allow user impersonation. The RPC handlers are implicated as they process job submissions where user impersonation claims would be made. While exact code references are unavailable, the Cloudera bulletin specifically calls out task controller configuration fixes and MapReduce security components, strongly indicating these areas. The high confidence for LinuxTaskController comes from its direct role in user switching and historical precedent in Hadoop security issues.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.hadoop:hadoop-main | maven | >= 0.23, < 0.23.2 | 0.23.2 |
| org.apache.hadoop:hadoop-main | maven | >= 1.0, < 1.0.2 | 1.0.2 |