CVE-2016-5001

State: Published
Severity: Not scored
Published: Aug 30, 2017
Updated: Sep 16, 2024
Reserved: May 24, 2016

Description

This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of HDFS. A local user on an HDFS DataNode may be able to craft a block token that grants unauthorized read access to random files by guessing certain fields in the token.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
Apache HadoopApache Software Foundation	2.1.0 to 2.6.3Affected 2.7.0 to 2.7.1Affected

References

94950vdb-entry
[oss-security] 20161216 [SECURITY] CVE-2016-5001: Apache Hadoop Information Disclosuremailing-list
[flink-user] 20210703 Re: owasp-dependency-check is flagging flink 1.13 for scala 2.12.7mailing-list

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.