CVE-2022-25168

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-25168
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-25168.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-25168
Aliases
Downstream
CGA (4)
OESA (1)
Published
2022-08-04T14:30:17Z
Modified
2026-08-12T03:49:12Z
Summary
Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTar
Details

Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It has been used in Hadoop 2.x for yarn localization, which does enable remote code execution. It is used in Apache Spark, from the SQL command ADD ARCHIVE. As the ADD ARCHIVE command adds new binaries to the classpath, being able to execute shell scripts does not confer new permissions to the caller. SPARK-38305. "Check existence of file before untarring/zipping", which is included in 3.3.0, 3.1.4, 3.2.2, prevents shell commands being executed, regardless of which version of the hadoop libraries are in use. Users should upgrade to Apache Hadoop 2.10.2, 3.2.4, 3.3.3 or upper (including HADOOP-18136).

Database specific 
{
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/25xxx/CVE-2022-25168.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "2.0.0 to 2.10.1"
                },
                {
                    "last_affected": "2.0.0 to 2.10.1"
                },
                {
                    "introduced": "3.0.0-alpha to 3.2.3"
                },
                {
                    "last_affected": "3.0.0-alpha to 3.2.3"
                },
                {
                    "introduced": "3.3.0 to 3.3.2"
                },
                {
                    "last_affected": "3.3.0 to 3.3.2"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/apache/hadoop

Affected ranges

Type
GIT
Repo
https://github.com/apache/hadoop
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
1827467c9a56f133025f28557bfc2c562d78e816
Introduced
c25427ceca461ee979d30edd7a4b0f50718e6533
Last Affected
abe5358143720085498613d399be3bbf01e0f131
Introduced
aa96f1871bfd858f9bac59cf2a81ec470da649af
Last Affected
0bcb014209e219273cb6fd4152df7df713cbac61
Introduced
6d9bbbf86ef1ede4b0c97e63ff4a6ea40806a860
Introduced
f335d509d3a778f11265d3f45800dd6e75f7be59
Introduced
2bde3aedf139368fc71f053d8dd6580b498ff46d
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.0.0"
        },
        {
            "last_affected": "2.10.1"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "last_affected": "3.2.3"
        },
        {
            "introduced": "3.3.0"
        },
        {
            "last_affected": "3.3.2"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

2.*
2.0.5-alpha-rc2
Other
HADOOP-12111-moved-to-yetus
YARN-2928-2016-06-21
YARN-2928-2016-07-08
YARN-2928-2016-07-10
YARN-5355-2016-11-06
YARN-5355-2017-04-25
YARN-5355-2017-08-31
YARN-5355-branch-2-2016-11-06
YARN-5355-branch-2-2017-04-25
YARN-5355_branch2-2017-08-31
YARN-5355_branch2-2017-10-14
YARN-5355_branch2-2017-10-17
YARN-7055-2018-03-02
feature_YARN-2928-2015-11-09
feature_YARN-2928-2016-01-20
feature_YARN-2928_2015-08-24
rel/release-
remove-ozone
branch-2.*
branch-2.0.6-alpha-rc0
cdh5-base-2.*
cdh5-base-2.6.0
ozone-0.*
ozone-0.2.1-alpha-RC0
ozone-0.3.0-alpha
ozone-0.3.0-alpha-RC0
ozone-0.3.0-alpha-RC1
ozone-0.4.0-alpha-RC0
ozone-0.4.0-alpha-RC1
ozone-0.4.0-alpha-RC2
ozone-0.4.1-alpha
ozone-0.4.1-alpha-RC0
rel/release-2.*
rel/release-2.10.0
rel/release-2.10.1
rel/release-2.10.2
rel/release-2.6.4
rel/release-2.6.5
rel/release-2.7.2
rel/release-2.7.3
rel/release-2.7.4
rel/release-2.7.5
rel/release-2.7.6
rel/release-2.7.7
rel/release-2.8.0
rel/release-2.8.1
rel/release-2.8.2
rel/release-2.8.3
rel/release-2.8.4
rel/release-2.8.5
rel/release-2.9.0
rel/release-2.9.1
rel/release-2.9.2
rel/release-3.*
rel/release-3.0.0
rel/release-3.0.0-alpha1
rel/release-3.0.0-alpha2
rel/release-3.0.0-alpha3
rel/release-3.0.0-alpha4
rel/release-3.0.0-beta1
rel/release-3.0.1
rel/release-3.0.2
rel/release-3.0.3
rel/release-3.1.0
rel/release-3.1.1
rel/release-3.1.2
rel/release-3.1.3
rel/release-3.1.4
rel/release-3.2.0
rel/release-3.2.1
rel/release-3.2.2
rel/release-3.2.3
rel/release-3.2.4
rel/release-3.3.0
rel/release-3.3.1
rel/release-3.3.2
rel/release-3.3.5
rel/release-3.3.6
rel/release-3.4.0
rel/release-3.4.1
rel/release-3.4.2
rel/release-3.4.3
rel/release-3.5.0
rel/release-X.*
rel/release-X.Y.Z
rel/submarine-0.*
rel/submarine-0.2.0
release-0.*
release-0.21.0
release-0.21.0-rc0
release-0.21.0-rc1
release-0.21.0-rc2
release-0.23.0
release-0.23.0-rc0
release-0.23.0-rc1
release-0.23.0-rc2
release-0.23.1
release-0.23.1-rc0
release-0.23.1-rc1
release-0.23.1-rc2
release-0.23.10
release-0.23.10-rc0
release-0.23.11
release-0.23.11-rc0
release-0.23.2-rc0
release-0.23.3
release-0.23.3-rc0
release-0.23.4
release-0.23.4-rc0
release-0.23.4-rc1
release-0.23.4-rc2
release-0.23.5
release-0.23.5-rc0
release-0.23.6
release-0.23.6-rc0
release-0.23.6-rc1
release-0.23.6-rc1-old
release-0.23.7
release-0.23.7-rc0
release-0.23.8
release-0.23.8-rc0
release-0.23.9
release-0.23.9-rc0
release-2.*
release-2.0.0-alpha
release-2.0.0-alpha-rc0
release-2.0.0-alpha-rc1
release-2.0.1-alpha
release-2.0.2-alpha
release-2.0.2-alpha-rc0
release-2.0.2-alpha-rc1
release-2.0.2-alpha-rc2
release-2.0.3-alpha
release-2.0.3-alpha-rc0
release-2.0.4-alpha
release-2.0.4-alpha-rc0
release-2.0.4-alpha-rc1
release-2.0.4-alpha-rc2
release-2.0.4.1-alpha-rc0
release-2.0.5-alpha
release-2.0.5-alpha-rc0
release-2.0.5-alpha-rc1
release-2.0.5-alpha-rc2
release-2.0.6-alpha
release-2.0.6-alpha-rc0
release-2.0.6-alpha-rc1
release-2.1.0-beta
release-2.1.0-beta-rc0
release-2.1.0-beta-rc1
release-2.1.0-beta-rc2
release-2.1.1-beta-rc0
release-2.1.1-rc0
release-2.10.0-RC0
release-2.10.0-RC1
release-2.10.1-RC0
release-2.10.2-RC0
release-2.2.0
release-2.2.0-rc0
release-2.2.1-rc0
release-2.3.0
release-2.3.0-rc0
release-2.4.0
release-2.4.0-rc0
release-2.4.1
release-2.4.1-rc0
release-2.4.1-rc1
release-2.5.0
release-2.5.0-rc0
release-2.5.0-rc1
release-2.5.0-rc2
release-2.5.1
release-2.5.2
release-2.5.2-RC0
release-2.5.2-RC1
release-2.6.0
release-2.6.0-rc0
release-2.6.0-rc1
release-2.6.1
release-2.6.1-RC0
release-2.6.1-RC1
release-2.6.2
release-2.6.2-RC0
release-2.6.3
release-2.6.3-RC0
release-2.6.3-RC0.1
release-2.6.3-RC1
release-2.6.4-RC0
release-2.6.5-RC0
release-2.6.5-RC1
release-2.7.0
release-2.7.0-RC0
release-2.7.1
release-2.7.1-RC0
release-2.7.2-RC0
release-2.7.2-RC1
release-2.7.2-RC2
release-2.7.3-RC0
release-2.7.3-RC1
release-2.7.3-RC2
release-2.7.4-RC0
release-2.7.5-RC0
release-2.7.5-RC1
release-2.7.6-RC0
release-2.7.7-RC0
release-2.8.0-RC0
release-2.8.0-RC1
release-2.8.0-RC2
release-2.8.0-RC3
release-2.8.2-RC0
release-2.8.2-RC1
release-2.8.3-RC0
release-2.8.4-RC0
release-2.8.5-RC0
release-2.9.0-RC0
release-2.9.0-RC1
release-2.9.0-RC2
release-2.9.0-RC3
release-2.9.1-RC0
release-2.9.2-RC0
release-3.*
release-3.0.0-RC0
release-3.0.0-RC1
release-3.0.0-alpha1-RC0
release-3.0.0-alpha2-RC0
release-3.0.0-alpha4-RC0
release-3.0.0-beta1-RC0
release-3.0.1-RC0
release-3.0.1-RC1
release-3.0.2-RC0
release-3.0.2-RC1
release-3.0.3-RC0
release-3.1.0-RC0
release-3.1.0-RC1
release-3.1.1-RC0
release-3.1.2-RC0
release-3.1.2-RC1
release-3.1.3-RC0
release-3.1.4-RC0
release-3.1.4-RC1
release-3.1.4-RC2
release-3.1.4-RC3
release-3.1.4-RC4
release-3.2.0-RC0
release-3.2.0-RC1
release-3.2.1-RC0
release-3.2.2-RC0
release-3.2.2-RC1
release-3.2.2-RC2
release-3.2.2-RC3
release-3.2.2-RC4
release-3.2.2-RC5
release-3.2.3-RC0
release-3.2.3-RC1
release-3.2.4-RC0
release-3.3.0-RC0
release-3.3.1-RC0
release-3.3.1-RC1
release-3.3.1-RC2
release-3.3.1-RC3
release-3.3.2-RC0
release-3.3.2-RC1
release-3.3.2-RC2
release-3.3.2-RC3
release-3.3.2-RC4
release-3.3.2-RC5
release-3.3.5-RC0
release-3.3.5-RC1
release-3.3.5-RC2
release-3.3.5-RC3
release-3.3.6-RC0
release-3.3.6-RC1
release-3.4.0-RC0
release-3.4.0-RC1
release-3.4.0-RC2
release-3.4.0-RC3
release-3.4.1-RC1
release-3.4.1-RC2
release-3.4.1-RC3
release-3.4.2-RC1
release-3.4.2-RC2
release-3.4.2-RC3
release-3.4.3-RC0
release-3.4.3-RC1
release-3.5.0-RC0
release-3.5.0-RC1
release-3.5.0-RC2
submarine-0.*
submarine-0.2.0-RC0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-25168.json"