CVE-2024-23454

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-23454
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-23454.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-23454
Aliases
Downstream
Published
2024-09-25T07:45:43.496Z
Modified
2026-08-12T04:01:19.686604653Z
Severity
  • 6.2 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Apache Hadoop: Temporary File Local Information Disclosure
Details

Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local users. As such, files written in this directory, without setting the correct posix permissions explicitly, may be viewable by all other local users.

Database specific 
{
    "cwe_ids": [
        "CWE-378"
    ],
    "cna_assigner": "apache",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "3.4.0"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23454.json"
}
References

Affected packages

Git / github.com/apache/hadoop

Affected ranges

Type
GIT
Repo
https://github.com/apache/hadoop
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
bd8b77f398f626bb7791783192ee7a5dfaeec760
Fixed
65a2bdeeead0c4826588f2bb05b10bb307a2727f
Database specific
Show details 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.4.0"
        }
    ]
}

Affected versions

2.*
2.0.5-alpha-rc2
Other
HADOOP-12111-moved-to-yetus
YARN-2928-2016-06-21
YARN-2928-2016-07-08
YARN-2928-2016-07-10
YARN-5355-2016-11-06
YARN-5355-2017-04-25
YARN-5355-2017-08-31
YARN-5355-branch-2-2016-11-06
YARN-5355-branch-2-2017-04-25
YARN-5355_branch2-2017-08-31
YARN-5355_branch2-2017-10-14
YARN-5355_branch2-2017-10-17
YARN-7055-2018-03-02
feature_YARN-2928-2015-11-09
feature_YARN-2928-2016-01-20
feature_YARN-2928_2015-08-24
rel/release-
remove-ozone
branch-2.*
branch-2.0.6-alpha-rc0
cdh5-base-2.*
cdh5-base-2.6.0
ozone-0.*
ozone-0.2.1-alpha-RC0
ozone-0.3.0-alpha
ozone-0.3.0-alpha-RC0
ozone-0.3.0-alpha-RC1
ozone-0.4.0-alpha-RC0
ozone-0.4.0-alpha-RC1
ozone-0.4.0-alpha-RC2
ozone-0.4.1-alpha
ozone-0.4.1-alpha-RC0
rel/release-2.*
rel/release-2.10.0
rel/release-2.10.1
rel/release-2.10.2
rel/release-2.6.4
rel/release-2.6.5
rel/release-2.7.2
rel/release-2.7.3
rel/release-2.7.4
rel/release-2.7.5
rel/release-2.7.6
rel/release-2.7.7
rel/release-2.8.0
rel/release-2.8.1
rel/release-2.8.2
rel/release-2.8.3
rel/release-2.8.4
rel/release-2.8.5
rel/release-2.9.0
rel/release-2.9.1
rel/release-2.9.2
rel/release-3.*
rel/release-3.0.0
rel/release-3.0.0-alpha1
rel/release-3.0.0-alpha2
rel/release-3.0.0-alpha3
rel/release-3.0.0-alpha4
rel/release-3.0.0-beta1
rel/release-3.0.1
rel/release-3.0.2
rel/release-3.0.3
rel/release-3.1.0
rel/release-3.1.1
rel/release-3.1.2
rel/release-3.1.3
rel/release-3.1.4
rel/release-3.2.0
rel/release-3.2.1
rel/release-3.2.2
rel/release-3.2.3
rel/release-3.2.4
rel/release-3.3.0
rel/release-3.3.1
rel/release-3.3.2
rel/release-3.3.3
rel/release-3.3.4
rel/release-3.3.5
rel/release-3.3.6
rel/release-3.5.0
rel/release-X.*
rel/release-X.Y.Z
rel/submarine-0.*
rel/submarine-0.2.0
release-0.*
release-0.21.0
release-0.21.0-rc0
release-0.21.0-rc1
release-0.21.0-rc2
release-0.23.0
release-0.23.0-rc0
release-0.23.0-rc1
release-0.23.0-rc2
release-0.23.1
release-0.23.1-rc0
release-0.23.1-rc1
release-0.23.1-rc2
release-0.23.10
release-0.23.10-rc0
release-0.23.11
release-0.23.11-rc0
release-0.23.2-rc0
release-0.23.3
release-0.23.3-rc0
release-0.23.4
release-0.23.4-rc0
release-0.23.4-rc1
release-0.23.4-rc2
release-0.23.5
release-0.23.5-rc0
release-0.23.6
release-0.23.6-rc0
release-0.23.6-rc1
release-0.23.6-rc1-old
release-0.23.7
release-0.23.7-rc0
release-0.23.8
release-0.23.8-rc0
release-0.23.9
release-0.23.9-rc0
release-2.*
release-2.0.0-alpha
release-2.0.0-alpha-rc0
release-2.0.0-alpha-rc1
release-2.0.1-alpha
release-2.0.2-alpha
release-2.0.2-alpha-rc0
release-2.0.2-alpha-rc1
release-2.0.2-alpha-rc2
release-2.0.3-alpha
release-2.0.3-alpha-rc0
release-2.0.4-alpha
release-2.0.4-alpha-rc0
release-2.0.4-alpha-rc1
release-2.0.4-alpha-rc2
release-2.0.4.1-alpha-rc0
release-2.0.5-alpha
release-2.0.5-alpha-rc0
release-2.0.5-alpha-rc1
release-2.0.5-alpha-rc2
release-2.0.6-alpha
release-2.0.6-alpha-rc0
release-2.0.6-alpha-rc1
release-2.1.0-beta
release-2.1.0-beta-rc0
release-2.1.0-beta-rc1
release-2.1.0-beta-rc2
release-2.1.1-beta-rc0
release-2.1.1-rc0
release-2.10.0-RC0
release-2.10.0-RC1
release-2.10.1-RC0
release-2.10.2-RC0
release-2.2.0
release-2.2.0-rc0
release-2.2.1-rc0
release-2.3.0
release-2.3.0-rc0
release-2.4.0
release-2.4.0-rc0
release-2.4.1
release-2.4.1-rc0
release-2.4.1-rc1
release-2.5.0
release-2.5.0-rc0
release-2.5.0-rc1
release-2.5.0-rc2
release-2.5.1
release-2.5.2
release-2.5.2-RC0
release-2.5.2-RC1
release-2.6.0
release-2.6.0-rc0
release-2.6.0-rc1
release-2.6.1
release-2.6.1-RC0
release-2.6.1-RC1
release-2.6.2
release-2.6.2-RC0
release-2.6.3
release-2.6.3-RC0
release-2.6.3-RC0.1
release-2.6.3-RC1
release-2.6.4-RC0
release-2.6.5-RC0
release-2.6.5-RC1
release-2.7.0
release-2.7.0-RC0
release-2.7.1
release-2.7.1-RC0
release-2.7.2-RC0
release-2.7.2-RC1
release-2.7.2-RC2
release-2.7.3-RC0
release-2.7.3-RC1
release-2.7.3-RC2
release-2.7.4-RC0
release-2.7.5-RC0
release-2.7.5-RC1
release-2.7.6-RC0
release-2.7.7-RC0
release-2.8.0-RC0
release-2.8.0-RC1
release-2.8.0-RC2
release-2.8.0-RC3
release-2.8.2-RC0
release-2.8.2-RC1
release-2.8.3-RC0
release-2.8.4-RC0
release-2.8.5-RC0
release-2.9.0-RC0
release-2.9.0-RC1
release-2.9.0-RC2
release-2.9.0-RC3
release-2.9.1-RC0
release-2.9.2-RC0
release-3.*
release-3.0.0-RC0
release-3.0.0-RC1
release-3.0.0-alpha1-RC0
release-3.0.0-alpha2-RC0
release-3.0.0-alpha4-RC0
release-3.0.0-beta1-RC0
release-3.0.1-RC0
release-3.0.1-RC1
release-3.0.2-RC0
release-3.0.2-RC1
release-3.0.3-RC0
release-3.1.0-RC0
release-3.1.0-RC1
release-3.1.1-RC0
release-3.1.2-RC0
release-3.1.2-RC1
release-3.1.3-RC0
release-3.1.4-RC0
release-3.1.4-RC1
release-3.1.4-RC2
release-3.1.4-RC3
release-3.1.4-RC4
release-3.2.0-RC0
release-3.2.0-RC1
release-3.2.1-RC0
release-3.2.2-RC0
release-3.2.2-RC1
release-3.2.2-RC2
release-3.2.2-RC3
release-3.2.2-RC4
release-3.2.2-RC5
release-3.2.3-RC0
release-3.2.3-RC1
release-3.2.4-RC0
release-3.3.0-RC0
release-3.3.1-RC0
release-3.3.1-RC1
release-3.3.1-RC2
release-3.3.1-RC3
release-3.3.2-RC0
release-3.3.2-RC1
release-3.3.2-RC2
release-3.3.2-RC3
release-3.3.2-RC4
release-3.3.2-RC5
release-3.3.3-RC0
release-3.3.3-RC1
release-3.3.4-RC0
release-3.3.4-RC1
release-3.3.5-RC0
release-3.3.5-RC1
release-3.3.5-RC2
release-3.3.5-RC3
release-3.3.6-RC0
release-3.3.6-RC1
release-3.4.0-RC0
release-3.4.0-RC1
release-3.4.0-RC2
release-3.5.0-RC0
release-3.5.0-RC1
release-3.5.0-RC2
submarine-0.*
submarine-0.2.0-RC0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-23454.json"