Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local users. As such, files written in this directory, without setting the correct posix permissions explicitly, may be viewable by all other local users.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive
    data will be present in this file, all the other local users may be able to view the content. This is
    because, on unix-like systems, the system temporary directory is shared between all local users. As such,
    files written in this directory, without setting the correct posix permissions explicitly, may be viewable
    by all other local users. (CVE-2024-23454)

ID	Name	Product	Family	Type	Severity
460245	Echo: hadoop-common, org.apache.hadoop:hadoop-common: security update to 3.4.0	Tenable Cloud Security	Echo Local Security Checks	Local	low
460245	Echo: hadoop-common, org.apache.hadoop:hadoop-common: security update to 3.4.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	low
414294	SCA: security update for org.apache.hadoop:hadoop-common (GHSA-f5fw-25gw-5m92)	Tenable Cloud Security	SCA Checks	Local	low
414294	SCA: security update for org.apache.hadoop:hadoop-common (GHSA-f5fw-25gw-5m92)	Tenable Self-Hosted Container Security	SCA Checks	Local	low

Detections

Analytics

CVE-2024-23454

low

Tenable Plugins

low

low

low

low