CVE-2018-11767 : In Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6, KMS blocking us

In Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6, KMS blocking users or granting access to users incorrectly, if the system uses non-default groups mapping mechanisms.

Published 2019-03-21 16:00:12

Updated 2019-10-03 00:03:26

Source Apache Software Foundation

View at NVD, CVE.org

Products affected by CVE-2018-11767

Apache » Hadoop
Versions from including (>=) 2.9.0 and up to, including, (<=) 2.9.1
cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*
Matching versions
Apache » Hadoop
Versions from including (>=) 2.7.5 and up to, including, (<=) 2.7.6
cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*
Matching versions
Apache » Hadoop
Versions from including (>=) 2.8.3 and up to, including, (<=) 2.8.4
cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2018-11767

EPSS FAQ

0.19%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 56 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-11767

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:N/A:P	8.6	4.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: Partial
7.4	HIGH	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H	2.2	5.2	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: High

CWE ids for CVE-2018-11767

CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-11767

https://lists.apache.org/thread.html/5fb771f66946dd5c99a8a5713347c24873846f555d716f9ac17bccca@%3Cgeneral.hadoop.apache.org%3E

CVE-2018-11767: Apache Hadoop KMS ACL regression - Pony Mail
Mailing List;Vendor Advisory
https://lists.apache.org/thread.html/5a44590b4eedc5e25f5bd3081d1631b52c174b5b99157f7950ddc270@%3Ccommon-dev.hadoop.apache.org%3E

[jira] [Created] (HADOOP-16200) Add regression test for CVE-2018-11767 - Pony Mail
Mailing List;Vendor Advisory
https://security.netapp.com/advisory/ntap-20190416-0009/

CVE-2018-11767 Apache Hadoop Vulnerability in NetApp Products | NetApp Product Security
https://lists.apache.org/thread.html/246cf223e7dc0c1dff90b78dccb6c3fe94e1a044dbf98e2333393302@%3Ccommon-issues.hadoop.apache.org%3E

[jira] [Created] (HADOOP-16200) Add regression test for CVE-2018-11767 - Pony Mail
Mailing List;Vendor Advisory
https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E

[GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities - Pony Mail

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2018-11767

Products affected by CVE-2018-11767

Exploit prediction scoring system (EPSS) score for CVE-2018-11767

CVSS scores for CVE-2018-11767

CWE ids for CVE-2018-11767

References for CVE-2018-11767