chore(deps): update dependency org.apache.hadoop:hadoop-common to v3.4.0 [security]

[anaconda-renovate]

This PR contains the following updates:

Package	Type	Update	Change
org.apache.hadoop:hadoop-common	compile	minor	3.3.2 → 3.4.0

renovate update details

Field	Value
manager	maven
categories	java
datasource	maven
depName	org.apache.hadoop:hadoop-common
depType¹	compile
packageName	org.apache.hadoop:hadoop-common
sourceUrl
updateType	minor
versioning	maven

¹ only available for some managers

---

Apache Hadoop argument injection vulnerability

CVE-2022-25168 / GHSA-8wm5-8h9c-47pc

More information

Details

Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It has been used in Hadoop 2.x for yarn localization, which does enable remote code execution. It is used in Apache Spark, from the SQL command ADD ARCHIVE. As the ADD ARCHIVE command adds new binaries to the classpath, being able to execute shell scripts does not confer new permissions to the caller. SPARK-38305. "Check existence of file before untarring/zipping", which is included in 3.3.0, 3.1.4, 3.2.2, prevents shell commands being executed, regardless of which version of the hadoop libraries are in use. Users should upgrade to Apache Hadoop 2.10.2, 3.2.4, 3.3.3 or upper (including HADOOP-18136).

Severity

• CVSS Score: 9.8 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-25168
• https://lists.apache.org/thread/mxqnb39jfrwgs3j6phwvlrfq4mlox130
• https://github.com/apache/hadoop/commit/cae749b076f35f0be13a926ee8cfbb7ce4402746
• https://security.netapp.com/advisory/ntap-20220915-0007/
• https://github.com/advisories/GHSA-8wm5-8h9c-47pc

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Apache Hadoop: Temporary File Local Information Disclosure

CVE-2024-23454 / GHSA-f5fw-25gw-5m92

More information

Details

Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local users. As such, files written in this directory, without setting the correct posix permissions explicitly, may be viewable by all other local users.

Severity

• CVSS Score: 2.0 / 10 (Low)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-23454
• https://issues.apache.org/jira/browse/HADOOP-19031
• https://lists.apache.org/thread/xlo7q8kn4tsjvx059r789oz19hzgfkfs
• https://github.com/apache/hadoop/commit/8c2836402fbb2f619f1fef4ef625a8542e853a64
• https://security.netapp.com/advisory/ntap-20241101-0002
• http://www.openwall.com/lists/oss-security/2024/09/25/1
• https://github.com/advisories/GHSA-f5fw-25gw-5m92

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Path traversal in Hadoop

CVE-2022-26612 / GHSA-gx2c-fvhc-ph4j

More information

Details

In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. As a result, a TAR entry may create a symlink under the expected extraction directory which points to an external directory. A subsequent TAR entry may extract an arbitrary file into the external directory using the symlink name. This however would be caught by the same targetDirPath check on Unix because of the getCanonicalPath call. However on Windows, getCanonicalPath doesn't resolve symbolic links, which bypasses the check. unpackEntries during TAR extraction follows symbolic links which allows writing outside expected base directory on Windows. This was addressed in Apache Hadoop 2.10.2, 3.2.3, 3.3.3, and 3.4.0.

Severity

• CVSS Score: 9.8 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-26612
• https://lists.apache.org/thread/hslo7wzw2449gv1jyjk8g6ttd7935fyz
• https://github.com/apache/hadoop/commits/rel/release-2.10.2/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileUtil.java
• https://github.com/apache/hadoop/commits/rel/release-3.2.3/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileUtil.java
• https://github.com/apache/hadoop/commits/rel/release-3.3.3/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileUtil.java
• https://github.com/apache/hadoop/commits/rel/release-3.4.0/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileUtil.java
• https://issues.apache.org/jira/browse/HADOOP-18317
• https://security.netapp.com/advisory/ntap-20220519-0004
• https://github.com/advisories/GHSA-gx2c-fvhc-ph4j

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Apache Hadoop argument injection vulnerability

CVE-2022-25168 / GHSA-8wm5-8h9c-47pc

More information

Details

Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It has been used in Hadoop 2.x for yarn localization, which does enable remote code execution. It is used in Apache Spark, from the SQL command ADD ARCHIVE. As the ADD ARCHIVE command adds new binaries to the classpath, being able to execute shell scripts does not confer new permissions to the caller. SPARK-38305. "Check existence of file before untarring/zipping", which is included in 3.3.0, 3.1.4, 3.2.2, prevents shell commands being executed, regardless of which version of the hadoop libraries are in use. Users should upgrade to Apache Hadoop 2.10.2, 3.2.4, 3.3.3 or upper (including HADOOP-18136).

Severity

• CVSS Score: 9.8 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-25168
• https://github.com/apache/hadoop/commit/cae749b076f35f0be13a926ee8cfbb7ce4402746
• https://github.com/apache/hadoop
• https://lists.apache.org/thread/mxqnb39jfrwgs3j6phwvlrfq4mlox130
• https://security.netapp.com/advisory/ntap-20220915-0007

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Path traversal in Hadoop

CVE-2022-26612 / GHSA-gx2c-fvhc-ph4j

More information

Details

In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. As a result, a TAR entry may create a symlink under the expected extraction directory which points to an external directory. A subsequent TAR entry may extract an arbitrary file into the external directory using the symlink name. This however would be caught by the same targetDirPath check on Unix because of the getCanonicalPath call. However on Windows, getCanonicalPath doesn't resolve symbolic links, which bypasses the check. unpackEntries during TAR extraction follows symbolic links which allows writing outside expected base directory on Windows. This was addressed in Apache Hadoop 2.10.2, 3.2.3, 3.3.3, and 3.4.0.

Severity

• CVSS Score: 9.8 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-26612
• https://github.com/apache/hadoop
• https://github.com/apache/hadoop/commits/rel/release-2.10.2/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileUtil.java
• https://github.com/apache/hadoop/commits/rel/release-3.2.3/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileUtil.java
• https://github.com/apache/hadoop/commits/rel/release-3.3.3/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileUtil.java
• https://github.com/apache/hadoop/commits/rel/release-3.4.0/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileUtil.java
• https://issues.apache.org/jira/browse/HADOOP-18317
• https://lists.apache.org/thread/hslo7wzw2449gv1jyjk8g6ttd7935fyz
• https://security.netapp.com/advisory/ntap-20220519-0004

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Apache Hadoop: Temporary File Local Information Disclosure

CVE-2024-23454 / GHSA-f5fw-25gw-5m92

More information

Details

Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local users. As such, files written in this directory, without setting the correct posix permissions explicitly, may be viewable by all other local users.

Severity

• CVSS Score: 2.0 / 10 (Low)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-23454
• https://github.com/apache/hadoop/commit/8c2836402fbb2f619f1fef4ef625a8542e853a64
• https://github.com/apache/hadoop
• https://issues.apache.org/jira/browse/HADOOP-19031
• https://lists.apache.org/thread/xlo7q8kn4tsjvx059r789oz19hzgfkfs
• https://security.netapp.com/advisory/ntap-20241101-0002
• http://www.openwall.com/lists/oss-security/2024/09/25/1

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.