Vulnerability Details CVE-2016-3086
The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for credential store provider used by the NodeManager to YARN Applications.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 61.6%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 5.0
References
- http://mail-archives.apache.org/mod_mbox/hadoop-general/201701.mbox/%3C0ed32746-5a53-9051-5877-2b1abd88beb6%40apache.org%3E
- http://www.securityfocus.com/bid/95335
- http://mail-archives.apache.org/mod_mbox/hadoop-general/201701.mbox/%3C0ed32746-5a53-9051-5877-2b1abd88beb6%40apache.org%3E
- http://www.securityfocus.com/bid/95335
Products affected by CVE-2016-3086
-
cpe:2.3:a:apache:hadoop:2.6.0
-
cpe:2.3:a:apache:hadoop:2.6.1
-
cpe:2.3:a:apache:hadoop:2.6.2
-
cpe:2.3:a:apache:hadoop:2.6.3
-
cpe:2.3:a:apache:hadoop:2.6.4
-
cpe:2.3:a:apache:hadoop:2.7.0
-
cpe:2.3:a:apache:hadoop:2.7.1
-
cpe:2.3:a:apache:hadoop:2.7.2