CVE-2014-3627
- State
- Published
- Severity
- Not scored
- Published
- Dec 5, 2014
- Updated
- Aug 6, 2024
- Reserved
- May 14, 2014
Description
The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote cluster users to change the permissions of certain files to world-readable via a symlink attack in a public tar archive, which is not properly handled during localization, related to distributed cache.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- [hadoop-general] 20141121 [ANNOUNCE] Apache Hadoop 2.5.2 releasedmailing-list
- 60079third-party-advisory
- 60432third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.