-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from libhdfs's native code mishandling user-provided file paths. The description explicitly states that opening unvalidated paths triggers the overflow. The most plausible candidate is hdfsOpenFile (or similar file-opening logic in libhdfs), which interfaces with Java via JNI. The lack of path length validation before buffer copy operations would directly cause the described heap overflow. While the exact pre-patch code isn't available, the CWE mappings and libhdfs architecture strongly implicate file-opening functions in the native layer as the vulnerable entry point.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.hadoop:hadoop-common | maven | >= 3.3.0, < 3.3.2 | 3.3.2 |
| org.apache.hadoop:hadoop-common | maven | >= 3.0.0, < 3.2.3 | 3.2.3 |
| org.apache.hadoop:hadoop-common | maven | < 2.10.2 | 2.10.2 |