An update for hadoop is now available for openEuler-20.03-LTS-SP1
Security Advisory
openeuler-security@openeuler.org
openEuler security committee
openEuler-SA-2021-1201
Final
1.0
1.0
2021-05-30
Initial
2021-05-30
2021-05-30
openEuler SA Tool V1.0
2021-05-30
hadoop security update
An update for hadoop is now available for openEuler-20.03-LTS-SP1.
Apache Hadoop is a framework that allows for the distributed processing of large data sets across clusters of computers using simple programming models. It is designed to scale up from single servers to thousands of machines, each offering local computation and storage.
Security Fix(es):
In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without proper verification.(CVE-2020-9492)
An update for hadoop is now available for openEuler-20.03-LTS-SP1.
openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.
High
hadoop
https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1201
https://openeuler.org/en/security/cve/detail.html?id=CVE-2020-9492
https://nvd.nist.gov/vuln/detail/CVE-2020-9492
openEuler-20.03-LTS-SP1
libhdfs-3.2.1-7.oe1.aarch64.rpm
hadoop-common-native-3.2.1-7.oe1.aarch64.rpm
hadoop-yarn-security-3.2.1-7.oe1.aarch64.rpm
hadoop-debuginfo-3.2.1-7.oe1.aarch64.rpm
hadoop-devel-3.2.1-7.oe1.aarch64.rpm
hadoop-debugsource-3.2.1-7.oe1.aarch64.rpm
hadoop-mapreduce-3.2.1-7.oe1.noarch.rpm
hadoop-common-3.2.1-7.oe1.noarch.rpm
hadoop-maven-plugin-3.2.1-7.oe1.noarch.rpm
hadoop-httpfs-3.2.1-7.oe1.noarch.rpm
hadoop-yarn-3.2.1-7.oe1.noarch.rpm
hadoop-hdfs-3.2.1-7.oe1.noarch.rpm
hadoop-mapreduce-examples-3.2.1-7.oe1.noarch.rpm
hadoop-client-3.2.1-7.oe1.noarch.rpm
hadoop-tests-3.2.1-7.oe1.noarch.rpm
hadoop-3.2.1-7.oe1.src.rpm
libhdfs-3.2.1-7.oe1.x86_64.rpm
hadoop-debuginfo-3.2.1-7.oe1.x86_64.rpm
hadoop-debugsource-3.2.1-7.oe1.x86_64.rpm
hadoop-yarn-security-3.2.1-7.oe1.x86_64.rpm
hadoop-common-native-3.2.1-7.oe1.x86_64.rpm
hadoop-devel-3.2.1-7.oe1.x86_64.rpm
In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without proper verification.
2021-05-30
CVE-2020-9492
openEuler-20.03-LTS-SP1
High
8.8
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
hadoop security update
2021-05-30
https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1201