CVE-2018-1296
N/A
Published: February 7, 2019 at 10:00 PM UTC
Updated: June 17, 2026 at 01:50 AM UTC
1 product affected across 1 vendorHadoop
Using Apache Hadoop by Apache Software Foundation?
Get instant alerts when new vulnerabilities affect Apache Hadoop - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 3%
Description
In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, HDFS exposes extended attribute key/value pairs during listXAttrs, verifying only path-level search access to the directory rather than path-level read permission to the referent.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
v ≤ 2.7.52.5.0 ≤ v ≤ 2.7.52.8.02.8.12.8.22.8.32.9.03.0.03.0.0 alpha13.0.0 alpha23.0.0 alpha33.0.0 alpha43.0.0 beta1
Remediation
No guide yetNo remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.
References (2)
VDB Entryx_refsource_BIDThird Party Advisory
Source: [email protected]
http://www.securityfocus.com/bid/106764Quick Info
StatusMODIFIED
CWE
CWE-200
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card