CVE-2021-37404
Fixed upstream EPSS 3%
There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may result in a denial of service or arbitrary code execution. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.
Products: Apache Software Foundation Apache Hadoop
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.hadoop:hadoop-common | 3.3.2 |
| Maven | org.apache.hadoop:hadoop-common | 3.2.3 |
| Maven | org.apache.hadoop:hadoop-common | 2.10.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | hadoop-fips-3.3.6 | no fix |