GCVE - cpe:2.3:a:apache:hadoop:2.6.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:hadoop:2.6.1:*:*:*:*:*:*:*

part: a version: 2.6.1 update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Hadoop (`69f26508-0b29-5671-ae34-5898b6ed48d6`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:apache/hadoop`	purl2cpe	2026-06-01 10:14:26.774924
`pkg:dokcer/apache/hadoop`	purl2cpe	2026-06-01 10:14:26.774925
`pkg:github/apache/hadoop`	purl2cpe	2026-06-01 10:14:26.774926
`pkg:maven/org.apache.hadoop/hadoop-core`	purl2cpe	2026-06-01 10:14:26.774928
`pkg:rpm/fedora/hadoop`	purl2cpe	2026-06-01 10:14:26.774929
`pkg:rpm/opensuse/hadoop`	purl2cpe	2026-06-01 10:14:26.774931

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-3166`	vulnerable	2026-06-08 05:09:26.716950	Details available In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, if a file in an encryption zone with access permissions that make it world readable is localized via YARN's localization mechanism, that file will be stored in a world-readable location and can be shared freely with any application that requests to localize that file. Published: 2017-11-13T14:00:00.000Z Updated: 2024-09-16T23:41:26.878Z Open on db.gcve.eu Reference links https://lists.apache.org/thread.html/2e16689b44bdd1976b6368c143a4017fc7159d1f2d02a5d54fe9310f%40%3Cgeneral.hadoop.apache.org%3E https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-5393`	vulnerable	2026-06-08 05:07:56.919693	Details available In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with the HDFS NameNode can possibly run arbitrary commands with the same privileges as the HDFS service. Published: 2016-11-29T06:00:00.000Z Updated: 2024-08-06T01:00:59.856Z Open on db.gcve.eu Reference links http://mail-archives.apache.org/mod_mbox/hadoop-general/201611.mbox/%3CCAA0W1bTbUmUUSF1rjRpX-2DvWutcrPt7TJSWUcSLg1F0gyHG1Q%40mail.gmail.com%3E http://www.securityfocus.com/bid/94574	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-3086`	vulnerable	2026-06-08 05:07:44.351432	Details available The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for credential store provider used by the NodeManager to YARN Applications. Published: 2017-09-05T13:00:00.000Z Updated: 2024-09-16T17:13:54.507Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/95335 http://mail-archives.apache.org/mod_mbox/hadoop-general/201701.mbox/%3C0ed32746-5a53-9051-5877-2b1abd88beb6%40apache.org%3E	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-1776`	vulnerable	2026-06-08 05:06:26.195309	Details available Apache Hadoop 2.6.x encrypts intermediate data generated by a MapReduce job and stores it along with the encryption key in a credentials file on disk when the Intermediate data encryption feature is enabled, which allows local users to obtain sensitive information by reading the file. Published: 2016-04-19T21:00:00.000Z Updated: 2024-08-06T04:54:15.459Z Open on db.gcve.eu Reference links http://mail-archives.apache.org/mod_mbox/hadoop-general/201602.mbox/%3CCAGCyb56CPgQMcxZ7jP87SfM5OKGx+E49DtrzCTQ6+nQf2a4nSA%40mail.gmail.com%3E http://www.securityfocus.com/bid/83259	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.