CVE-2018-11765: Potential information disclosure in Hadoop Web interfaces Severity: Important
Vendor: The Apache Software Foundation Versions affected: 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5 Description: When Kerberos authentication is enabled and SPNEGO through HTTP is not enabled, any users can access some servlets without authentication. Mitigation: Users should upgrade to Apache Hadoop 2.10.0, 3.0.1 or upper. If you are using the affected version of Apache Hadoop, you need to enable SPNEGO through HTTP. Credit: This issue was discovered by Owen O'Malley and reported by Larry McCay. --------------------------------------------------------------------- To unsubscribe, e-mail: user-unsubscr...@hadoop.apache.org For additional commands, e-mail: user-h...@hadoop.apache.org
