CVE-2018-11765
- State
- Published
- Severity
- Not scored
- Published
- Sep 30, 2020
- Updated
- Aug 5, 2024
- Reserved
- Jun 5, 2018
Description
In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication when Kerberos authentication is enabled and SPNEGO through HTTP is not enabled.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Apache Hadoopn/a |
|
References
- https://lists.apache.org/thread.html/r2c7f899911a04164ed1707083fcd4135f8427e04778c87d83509b0da%40%3Cgeneral.hadoop.apache.org%3E
- [druid-dev] 20201007 [CANCEL][VOTE] Release Apache Druid 0.20.0 [RC1]mailing-list
- [druid-commits] 20201007 [GitHub] [druid] jon-wei opened a new pull request #10485: Suppress CVE-2018-11765 for hadoop dependenciesmailing-list
- [druid-commits] 20201008 [druid] branch master updated: Suppress CVE-2018-11765 for hadoop dependencies (#10485)mailing-list
- [druid-commits] 20201008 [GitHub] [druid] jon-wei merged pull request #10485: Suppress CVE-2018-11765 for hadoop dependenciesmailing-list
- [druid-commits] 20201008 [GitHub] [druid] jon-wei opened a new pull request #10492: [Backport] Suppress CVE-2018-11765 for hadoop dependencies (#10485)mailing-list
- [druid-commits] 20201008 [druid] branch 0.20.0 updated: Suppress CVE-2018-11765 for hadoop dependencies (#10485) (#10492)mailing-list
- [druid-commits] 20201008 [GitHub] [druid] jon-wei merged pull request #10492: [Backport] Suppress CVE-2018-11765 for hadoop dependencies (#10485)mailing-list
- [druid-commits] 20201009 [GitHub] [druid] jon-wei merged pull request #10485: Suppress CVE-2018-11765 for hadoop dependenciesmailing-list
- [druid-commits] 20201009 [GitHub] [druid] jon-wei opened a new pull request #10492: [Backport] Suppress CVE-2018-11765 for hadoop dependencies (#10485)mailing-list
- [druid-commits] 20201009 [GitHub] [druid] jon-wei merged pull request #10492: [Backport] Suppress CVE-2018-11765 for hadoop dependencies (#10485)mailing-list
- https://security.netapp.com/advisory/ntap-20201016-0005/
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.