CVE-2018-11765

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2018-11765
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-11765.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2018-11765
Aliases
Published
2020-09-30T18:15:15Z
Modified
2026-10-24T10:33:35Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication when Kerberos authentication is enabled and SPNEGO through HTTP is not enabled.

References

Affected packages

Git / github.com/apache/hadoop

Affected ranges

Type
GIT
Repo
https://github.com/apache/hadoop
Events
Introduced
91f2b7a13d1e97be65db92ddabc627cc29ac0009
Last Affected
0b8464d75227fcee2c6e7f2410377b3d53d3d5f8
Introduced
756ebc8394e473ac25feac05fa493f6d612e6c50
Last Affected
826afbeae31ca687bc2f8471dc841b66ed2c6704
Introduced
c25427ceca461ee979d30edd7a4b0f50718e6533
Last Affected
1337ef4eef14fbbb214e71b68b7eb07061a4a212
Introduced
c0e5ad696adcb7c85011b9ac9b7948514384564d
Introduced
f894eefec1c55554c3b13ccd5becb4b60d9c4926
Introduced
12bd1aaac5b8862ea7c8ff4e47e61f34f379a327
Introduced
cb48eea922556500577dcf85ffeeea9edc33e895
Introduced
f871b7541a5375eb117eafb9a091e4f59401231f
Introduced
6d9bbbf86ef1ede4b0c97e63ff4a6ea40806a860
Introduced
f335d509d3a778f11265d3f45800dd6e75f7be59
Introduced
2bde3aedf139368fc71f053d8dd6580b498ff46d
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "2.8.0"
                },
                {
                    "last_affected": "2.8.5"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "2.9.0"
                },
                {
                    "last_affected": "2.9.2"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:apache:hadoop:3.0.0:-:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "3.0.0-NA"
                },
                {
                    "last_affected": "3.0.0-NA"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:apache:hadoop:3.0.0:alpha2:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "3.0.0-alpha2"
                },
                {
                    "last_affected": "3.0.0-alpha2"
                }
            ],
            "source": "CPE_STRING"
        }
    ]
}

Affected versions

3.*
3.0.0-NA
3.0.0-alpha2
Other
YARN-7055-2018-03-02
rel/release-
remove-ozone
ozone-0.*
ozone-0.2.1-alpha-RC0
ozone-0.3.0-alpha
ozone-0.3.0-alpha-RC0
ozone-0.3.0-alpha-RC1
ozone-0.4.0-alpha-RC0
ozone-0.4.0-alpha-RC1
ozone-0.4.0-alpha-RC2
ozone-0.4.1-alpha
ozone-0.4.1-alpha-RC0
rel/release-2.*
rel/release-2.10.0
rel/release-2.10.1
rel/release-2.10.2
rel/release-2.8.0
rel/release-2.8.1
rel/release-2.9.0
rel/release-2.9.1
rel/release-2.9.2
rel/release-3.*
rel/release-3.0.0
rel/release-3.0.1
rel/release-3.0.2
rel/release-3.0.3
rel/release-3.1.0
rel/release-3.1.1
rel/release-3.1.2
rel/release-3.1.3
rel/release-3.1.4
rel/release-3.2.0
rel/release-3.2.1
rel/release-3.2.2
rel/release-3.2.3
rel/release-3.2.4
rel/release-3.3.0
rel/release-3.3.1
rel/release-3.3.2
rel/release-3.3.3
rel/release-3.3.4
rel/release-3.3.5
rel/release-3.3.6
rel/release-3.4.0
rel/release-3.4.1
rel/release-3.4.2
rel/release-3.4.3
rel/release-3.5.0
rel/release-X.*
rel/release-X.Y.Z
rel/submarine-0.*
rel/submarine-0.2.0
release-2.*
release-2.10.0-RC0
release-2.10.0-RC1
release-2.10.1-RC0
release-2.10.2-RC0
release-2.8.0-RC3
release-2.9.0-RC3
release-2.9.1-RC0
release-2.9.2-RC0
release-3.*
release-3.0.0-RC0
release-3.0.0-RC1
release-3.0.1-RC0
release-3.0.1-RC1
release-3.0.2-RC0
release-3.0.2-RC1
release-3.0.3-RC0
release-3.1.0-RC0
release-3.1.0-RC1
release-3.1.1-RC0
release-3.1.2-RC0
release-3.1.2-RC1
release-3.1.3-RC0
release-3.1.4-RC0
release-3.1.4-RC1
release-3.1.4-RC2
release-3.1.4-RC3
release-3.1.4-RC4
release-3.2.0-RC0
release-3.2.0-RC1
release-3.2.1-RC0
release-3.2.2-RC0
release-3.2.2-RC1
release-3.2.2-RC2
release-3.2.2-RC3
release-3.2.2-RC4
release-3.2.2-RC5
release-3.2.3-RC0
release-3.2.3-RC1
release-3.2.4-RC0
release-3.3.0-RC0
release-3.3.1-RC0
release-3.3.1-RC1
release-3.3.1-RC2
release-3.3.1-RC3
release-3.3.2-RC0
release-3.3.2-RC1
release-3.3.2-RC2
release-3.3.2-RC3
release-3.3.2-RC4
release-3.3.2-RC5
release-3.3.3-RC0
release-3.3.3-RC1
release-3.3.4-RC0
release-3.3.4-RC1
release-3.3.5-RC0
release-3.3.5-RC1
release-3.3.5-RC2
release-3.3.5-RC3
release-3.3.6-RC0
release-3.3.6-RC1
release-3.4.0-RC0
release-3.4.0-RC1
release-3.4.0-RC2
release-3.4.0-RC3
release-3.4.1-RC1
release-3.4.1-RC2
release-3.4.1-RC3
release-3.4.2-RC1
release-3.4.2-RC2
release-3.4.2-RC3
release-3.4.3-RC0
release-3.4.3-RC1
release-3.5.0-RC0
release-3.5.0-RC1
release-3.5.0-RC2
submarine-0.*
submarine-0.2.0-RC0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-11765.json"