CVE-2020-9492 (High) detected in hadoop-hdfs-2.6.5.jar

[mend-for-github.aaakk.us.kg]

CVE-2020-9492 - High Severity Vulnerability

Vulnerable Library - hadoop-hdfs-2.6.5.jar

Apache Hadoop HDFS

Path to dependency file: /build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.hadoop/hadoop-hdfs/2.6.5/8bd0f95e29b9ba7960b4239a7f3706b37b183652/hadoop-hdfs-2.6.5.jar

Dependency Hierarchy:

• spark-sql_2.11-2.2.3.jar (Root Library)
  • spark-core_2.11-2.2.3.jar
    • hadoop-client-2.6.5.jar
      • ❌ hadoop-hdfs-2.6.5.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without proper verification.

Publish Date: 2021-01-26

URL: CVE-2020-9492

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://lists.apache.org/thread.html/rca4516b00b55b347905df45e5d0432186248223f30497db87aba8710@%3Cannounce.apache.org%3E

Release Date: 2021-01-26

Fix Resolution (org.apache.hadoop:hadoop-hdfs): 2.10.1

Direct dependency fix Resolution (org.apache.spark:spark-sql_2.11): 2.3.0

---

⛑️ Automatic Remediation will be attempted for this issue.