-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from how FileUtil.unTarUsingTar builds a shell command using untrusted filenames. The pre-patch code directly used FileUtil.makeSecureShellPath(inFile) in string interpolation without proper escaping, allowing command injection via malicious filenames. The commit diff shows the vulnerability was addressed by introducing proper shell path escaping via a new 'source' variable and makeSecureShellPath(). The added test cases validate protection against filenames containing command injection payloads (e.g., 'missing; true'). The CVE description explicitly calls out FileUtil.unTar() as the vulnerable API, which relies on unTarUsingTar for shell-based extraction.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.hadoop:hadoop-common | maven | >= 2.0.0, < 2.10.2 | 2.10.2 |
| org.apache.hadoop:hadoop-common | maven | >= 3.0.0-alpha, < 3.2.4 | 3.2.4 |
| org.apache.hadoop:hadoop-common | maven | >= 3.3.0, < 3.3.3 | 3.3.3 |