cve.bz

CVE-2018-8029

8.8 highEPSS 3.9%

High (8.8) in apache hadoop. EPSS 3.9% chance of exploitation in the next 30 days. Fixed in org.apache.hadoop:hadoop-main 2.8.4, 2.9.2, 3.1.1.

In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.

Severity

CVSS 3.0

8.8 high
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
3.9% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-10-31)
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-37pw-qw47-4jxmMavenorg.apache.hadoop:hadoop-main>=2.2.0 <2.8.42.8.4
GHSA-37pw-qw47-4jxmMavenorg.apache.hadoop:hadoop-main>=2.9.0 <2.9.22.9.2
GHSA-37pw-qw47-4jxmMavenorg.apache.hadoop:hadoop-main>=3.0.0 <3.1.13.1.1

References

Check your stackJSON