CVE-2018-11768
HIGH
7.5
CVSS Score
Published: October 4, 2019 at 01:56 PM UTC
Updated: June 17, 2026 at 01:36 AM UTC
1 product affected across 1 vendorHadoop
Using Apache Hadoop by N/A?
Get instant alerts when new vulnerabilities affect Apache Hadoop - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.5
Exploit prediction
EPSS 7%
Description
In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be corrupted across storing in fsimage and reading back from fsimage.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
v ≤ 2.8.42.2.0 ≤ v ≤ 2.8.42.9.0 ≤ v ≤ 2.9.13.0.1 ≤ v ≤ 3.0.33.1.0 ≤ v ≤ 3.1.12.0.02.0.0 alpha2.0.12.0.1 alpha2.0.22.0.2 alpha2.0.32.0.3 alpha2.0.42.0.4 alpha2.0.52.0.5 alpha2.0.62.0.6 alpha2.1.02.1.0 beta2.1.1 beta3.0.03.0.0 alpha13.0.0 alpha23.0.0 alpha33.0.0 alpha43.0.0 beta1
Remediation
No guide yetNo remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.
References (10)
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/2c9cc65864be0058a5d5ed2025dfb9c700bf23d352b0c826c36ff96a%40%3Chdfs-dev.hadoop.apache.org%3EMailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/72ca514e01cd5f08151e74f9929799b4cbe1b6e9e6cd24faa72ffcc6%40%3Cdev.lucene.apache.org%3EMailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/9b609d4392d886711e694cf40d86f770022baf42a1b1aa97e8244c87%40%3Cdev.lucene.apache.org%3EMailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/caacbbba2dcc1105163f76f3dfee5fbd22e0417e0783212787086378%40%3Cgeneral.hadoop.apache.org%3EMailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/ceb16af9139ab0fea24aef935b6321581976887df7ad632e9a515dda%40%3Cdev.lucene.apache.org%3EMailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/ea6d2dfbefab8ebe46be18b05136b83ae53b7866f1bc60c680a2b600%40%3Chdfs-dev.hadoop.apache.org%3EMailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/f20bb4e055d8394fc525cc7772fb84096f706389043e76220c8a29a4%40%3Chdfs-dev.hadoop.apache.org%3ECVSS
- Attack Vector
- NETWORK
- Complexity
- LOW
- Privileges
- NONE
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- NONE
- Integrity
- HIGH
- Availability
- NONE
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-119
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card