9.8crit
CVE-2016-3086
Exposure of Sensitive Information to an Unauthorized Actor in Apache Hadoop
Also known as GHSA-895m-ww55-59vw
Published 9 y ago · modified 4 mo ago · JSON
CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
3.6%
percentile 90%
Public exploits
0
none known
Summary
The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for credential store provider used by the NodeManager to YARN Applications.
Exploit prediction (EPSS)
3.65% probability of exploitation in the next 30 days, higher than 90% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| GitHub | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.hadoop:hadoop-yarn-server-nodemanager | >=2.6.0, <2.6.5 >=2.7.0, <2.7.3 | 2.6.5 2.7.3 |
Affected products
- Apache Software Foundation Apache Hadoop
Classification
- Weakness
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
- securityfocus.com /bid/95335 · vdb-entry, x_refsource_BID, x_transferred
- mail-archives.apache.org /mod_mbox/hadoop-general/201701.mbox/%3C0ed32746-5a53-9051-5877-2b1abd88beb6%40apache.org% · mailing-list, x_refsource_MLIST, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2016-3086 · advisory
Sources
- CVE List: CVE-2016-3086
- GitHub Advisory: GHSA-895m-ww55-59vw
- NVD: CVE-2016-3086
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.