CVE-2020-9492

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-9492
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-9492.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2020-9492
Aliases
Downstream
CGA (4)
OESA (1)
Published
2021-01-26T18:16:10Z
Modified
2026-08-18T04:05:07Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without proper verification.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "8.0.8.2.0"
                },
                {
                    "last_affected": "8.0.8.2.0"
                },
                {
                    "introduced": "8.0.8.3.0"
                },
                {
                    "last_affected": "8.0.8.3.0"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "oracle:financial_services_crime_and_compliance_management_studio"
        }
    ]
}
References

Affected packages

Git / github.com/apache/hadoop

Affected ranges

Type
GIT
Repo
https://github.com/apache/hadoop
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
e2f1f118e465e787d8567dfa6e2f3b72a0eb9194
Introduced
c25427ceca461ee979d30edd7a4b0f50718e6533
Last Affected
ba631c436b806728f8ec2f54ab1e289526c90579
Introduced
e97acb3bd8f3befd27418996fa5d4b50bf2e17bf
Last Affected
b3cbbb467e22ea829b3808f4b7b01d07e0bf3842
Introduced
6d9bbbf86ef1ede4b0c97e63ff4a6ea40806a860
Introduced
f335d509d3a778f11265d3f45800dd6e75f7be59
Introduced
2bde3aedf139368fc71f053d8dd6580b498ff46d
Introduced
7e73321f9e1c7c5a3c41da3265f1666a8e76c0a8
Introduced
a446949f568ed0269741f258bb50b3b4f95db142
Introduced
bba76b6f31d5452fe048dcc6853c12a1894024fe
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.0.0"
        },
        {
            "last_affected": "2.10.0"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "last_affected": "3.1.3"
        },
        {
            "introduced": "3.2.0"
        },
        {
            "last_affected": "3.2.1"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

2.*
2.0.5-alpha-rc2
Other
HADOOP-12111-moved-to-yetus
YARN-2928-2016-06-21
YARN-2928-2016-07-08
YARN-2928-2016-07-10
YARN-5355-2016-11-06
YARN-5355-2017-04-25
YARN-5355-2017-08-31
YARN-5355-branch-2-2016-11-06
YARN-5355-branch-2-2017-04-25
YARN-5355_branch2-2017-08-31
YARN-5355_branch2-2017-10-14
YARN-5355_branch2-2017-10-17
YARN-7055-2018-03-02
feature_YARN-2928-2015-11-09
feature_YARN-2928-2016-01-20
feature_YARN-2928_2015-08-24
rel/release-
remove-ozone
branch-2.*
branch-2.0.6-alpha-rc0
cdh5-base-2.*
cdh5-base-2.6.0
ozone-0.*
ozone-0.2.1-alpha-RC0
ozone-0.3.0-alpha
ozone-0.3.0-alpha-RC0
ozone-0.3.0-alpha-RC1
ozone-0.4.0-alpha-RC0
ozone-0.4.0-alpha-RC1
ozone-0.4.0-alpha-RC2
ozone-0.4.1-alpha
ozone-0.4.1-alpha-RC0
rel/release-2.*
rel/release-2.10.0
rel/release-2.10.1
rel/release-2.10.2
rel/release-2.6.4
rel/release-2.6.5
rel/release-2.7.2
rel/release-2.7.3
rel/release-2.7.4
rel/release-2.7.5
rel/release-2.7.6
rel/release-2.7.7
rel/release-2.8.0
rel/release-2.8.1
rel/release-2.8.2
rel/release-2.8.3
rel/release-2.8.4
rel/release-2.8.5
rel/release-2.9.0
rel/release-2.9.1
rel/release-2.9.2
rel/release-3.*
rel/release-3.0.0
rel/release-3.0.0-alpha1
rel/release-3.0.0-alpha2
rel/release-3.0.0-alpha3
rel/release-3.0.0-alpha4
rel/release-3.0.0-beta1
rel/release-3.0.1
rel/release-3.0.2
rel/release-3.0.3
rel/release-3.1.0
rel/release-3.1.1
rel/release-3.1.2
rel/release-3.1.3
rel/release-3.1.4
rel/release-3.2.0
rel/release-3.2.1
rel/release-3.2.2
rel/release-3.2.3
rel/release-3.2.4
rel/release-3.3.0
rel/release-3.3.1
rel/release-3.3.2
rel/release-3.3.3
rel/release-3.3.4
rel/release-3.3.5
rel/release-3.3.6
rel/release-3.4.0
rel/release-3.4.1
rel/release-3.4.2
rel/release-3.4.3
rel/release-3.5.0
rel/release-X.*
rel/release-X.Y.Z
rel/submarine-0.*
rel/submarine-0.2.0
release-0.*
release-0.21.0
release-0.21.0-rc0
release-0.21.0-rc1
release-0.21.0-rc2
release-0.23.0
release-0.23.0-rc0
release-0.23.0-rc1
release-0.23.0-rc2
release-0.23.1
release-0.23.1-rc0
release-0.23.1-rc1
release-0.23.1-rc2
release-0.23.10
release-0.23.10-rc0
release-0.23.11
release-0.23.11-rc0
release-0.23.2-rc0
release-0.23.3
release-0.23.3-rc0
release-0.23.4
release-0.23.4-rc0
release-0.23.4-rc1
release-0.23.4-rc2
release-0.23.5
release-0.23.5-rc0
release-0.23.6
release-0.23.6-rc0
release-0.23.6-rc1
release-0.23.6-rc1-old
release-0.23.7
release-0.23.7-rc0
release-0.23.8
release-0.23.8-rc0
release-0.23.9
release-0.23.9-rc0
release-2.*
release-2.0.0-alpha
release-2.0.0-alpha-rc0
release-2.0.0-alpha-rc1
release-2.0.1-alpha
release-2.0.2-alpha
release-2.0.2-alpha-rc0
release-2.0.2-alpha-rc1
release-2.0.2-alpha-rc2
release-2.0.3-alpha
release-2.0.3-alpha-rc0
release-2.0.4-alpha
release-2.0.4-alpha-rc0
release-2.0.4-alpha-rc1
release-2.0.4-alpha-rc2
release-2.0.4.1-alpha-rc0
release-2.0.5-alpha
release-2.0.5-alpha-rc0
release-2.0.5-alpha-rc1
release-2.0.5-alpha-rc2
release-2.0.6-alpha
release-2.0.6-alpha-rc0
release-2.0.6-alpha-rc1
release-2.1.0-beta
release-2.1.0-beta-rc0
release-2.1.0-beta-rc1
release-2.1.0-beta-rc2
release-2.1.1-beta-rc0
release-2.1.1-rc0
release-2.10.0-RC0
release-2.10.0-RC1
release-2.10.1-RC0
release-2.10.2-RC0
release-2.2.0
release-2.2.0-rc0
release-2.2.1-rc0
release-2.3.0
release-2.3.0-rc0
release-2.4.0
release-2.4.0-rc0
release-2.4.1
release-2.4.1-rc0
release-2.4.1-rc1
release-2.5.0
release-2.5.0-rc0
release-2.5.0-rc1
release-2.5.0-rc2
release-2.5.1
release-2.5.2
release-2.5.2-RC0
release-2.5.2-RC1
release-2.6.0
release-2.6.0-rc0
release-2.6.0-rc1
release-2.6.1
release-2.6.1-RC0
release-2.6.1-RC1
release-2.6.2
release-2.6.2-RC0
release-2.6.3
release-2.6.3-RC0
release-2.6.3-RC0.1
release-2.6.3-RC1
release-2.6.4-RC0
release-2.6.5-RC0
release-2.6.5-RC1
release-2.7.0
release-2.7.0-RC0
release-2.7.1
release-2.7.1-RC0
release-2.7.2-RC0
release-2.7.2-RC1
release-2.7.2-RC2
release-2.7.3-RC0
release-2.7.3-RC1
release-2.7.3-RC2
release-2.7.4-RC0
release-2.7.5-RC0
release-2.7.5-RC1
release-2.7.6-RC0
release-2.7.7-RC0
release-2.8.0-RC0
release-2.8.0-RC1
release-2.8.0-RC2
release-2.8.0-RC3
release-2.8.2-RC0
release-2.8.2-RC1
release-2.8.3-RC0
release-2.8.4-RC0
release-2.8.5-RC0
release-2.9.0-RC0
release-2.9.0-RC1
release-2.9.0-RC2
release-2.9.0-RC3
release-2.9.1-RC0
release-2.9.2-RC0
release-3.*
release-3.0.0-RC0
release-3.0.0-RC1
release-3.0.0-alpha1-RC0
release-3.0.0-alpha2-RC0
release-3.0.0-alpha4-RC0
release-3.0.0-beta1-RC0
release-3.0.1-RC0
release-3.0.1-RC1
release-3.0.2-RC0
release-3.0.2-RC1
release-3.0.3-RC0
release-3.1.0-RC0
release-3.1.0-RC1
release-3.1.1-RC0
release-3.1.2-RC0
release-3.1.2-RC1
release-3.1.3-RC0
release-3.1.4-RC0
release-3.1.4-RC1
release-3.1.4-RC2
release-3.1.4-RC3
release-3.1.4-RC4
release-3.2.0-RC0
release-3.2.0-RC1
release-3.2.1-RC0
release-3.2.2-RC0
release-3.2.2-RC1
release-3.2.2-RC2
release-3.2.2-RC3
release-3.2.2-RC4
release-3.2.2-RC5
release-3.2.3-RC0
release-3.2.3-RC1
release-3.2.4-RC0
release-3.3.0-RC0
release-3.3.1-RC0
release-3.3.1-RC1
release-3.3.1-RC2
release-3.3.1-RC3
release-3.3.2-RC0
release-3.3.2-RC1
release-3.3.2-RC2
release-3.3.2-RC3
release-3.3.2-RC4
release-3.3.2-RC5
release-3.3.3-RC0
release-3.3.3-RC1
release-3.3.4-RC0
release-3.3.4-RC1
release-3.3.5-RC0
release-3.3.5-RC1
release-3.3.5-RC2
release-3.3.5-RC3
release-3.3.6-RC0
release-3.3.6-RC1
release-3.4.0-RC0
release-3.4.0-RC1
release-3.4.0-RC2
release-3.4.0-RC3
release-3.4.1-RC1
release-3.4.1-RC2
release-3.4.1-RC3
release-3.4.2-RC1
release-3.4.2-RC2
release-3.4.2-RC3
release-3.4.3-RC0
release-3.4.3-RC1
release-3.5.0-RC0
release-3.5.0-RC1
release-3.5.0-RC2
submarine-0.*
submarine-0.2.0-RC0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-9492.json"

Git / github.com/apache/lucene-solr

Affected ranges

Type
GIT
Repo
https://github.com/apache/lucene-solr
Events
Introduced
a9c5fb0da2dfc8c7375622c80dbf1a0cc26f44dc
Last Affected
016993b65e393b58246d54e8ddda9f56a453eb0e
Database specific
Show details 
{
    "cpe": [
        "cpe:2.3:a:apache:solr:8.6.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:solr:8.6.2:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "8.6.0"
        },
        {
            "last_affected": "8.6.0"
        },
        {
            "introduced": "8.6.2"
        },
        {
            "last_affected": "8.6.2"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

8.*
8.6.0
8.6.2
releases/lucene-solr/8.*
releases/lucene-solr/8.6.0
releases/lucene-solr/8.6.1
releases/lucene-solr/8.6.2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-9492.json"

Git / github.com/apache/solr

Affected ranges

Type
GIT
Repo
https://github.com/apache/solr
Events
Introduced
a9c5fb0da2dfc8c7375622c80dbf1a0cc26f44dc
Last Affected
016993b65e393b58246d54e8ddda9f56a453eb0e
Database specific
Show details 
{
    "cpe": [
        "cpe:2.3:a:apache:solr:8.6.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:solr:8.6.2:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "8.6.0"
        },
        {
            "last_affected": "8.6.0"
        },
        {
            "introduced": "8.6.2"
        },
        {
            "last_affected": "8.6.2"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

8.*
8.6.0
8.6.2
releases/lucene-solr/8.*
releases/lucene-solr/8.6.0
releases/lucene-solr/8.6.1
releases/lucene-solr/8.6.2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-9492.json"