GCVE - cpe:2.3:a:apache:hadoop:2.7.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:hadoop:2.7.1:*:*:*:*:*:*:*

part: a version: 2.7.1 update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Hadoop (`69f26508-0b29-5671-ae34-5898b6ed48d6`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:apache/hadoop`	purl2cpe	2026-06-01 10:14:26.774978
`pkg:dokcer/apache/hadoop`	purl2cpe	2026-06-01 10:14:26.774980
`pkg:github/apache/hadoop`	purl2cpe	2026-06-01 10:14:26.774981
`pkg:maven/org.apache.hadoop/hadoop-core`	purl2cpe	2026-06-01 10:14:26.774982
`pkg:rpm/fedora/hadoop`	purl2cpe	2026-06-01 10:14:26.774984
`pkg:rpm/opensuse/hadoop`	purl2cpe	2026-06-01 10:14:26.774985

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-3166`	vulnerable	2026-06-08 05:09:26.721028	Details available In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, if a file in an encryption zone with access permissions that make it world readable is localized via YARN's localization mechanism, that file will be stored in a world-readable location and can be shared freely with any application that requests to localize that file. Published: 2017-11-13T14:00:00.000Z Updated: 2024-09-16T23:41:26.878Z Open on db.gcve.eu Reference links https://lists.apache.org/thread.html/2e16689b44bdd1976b6368c143a4017fc7159d1f2d02a5d54fe9310f%40%3Cgeneral.hadoop.apache.org%3E https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-5393`	vulnerable	2026-06-08 05:07:56.917725	Details available In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with the HDFS NameNode can possibly run arbitrary commands with the same privileges as the HDFS service. Published: 2016-11-29T06:00:00.000Z Updated: 2024-08-06T01:00:59.856Z Open on db.gcve.eu Reference links http://mail-archives.apache.org/mod_mbox/hadoop-general/201611.mbox/%3CCAA0W1bTbUmUUSF1rjRpX-2DvWutcrPt7TJSWUcSLg1F0gyHG1Q%40mail.gmail.com%3E http://www.securityfocus.com/bid/94574	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-5001`	vulnerable	2026-06-08 05:07:55.920425	Details available This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of HDFS. A local user on an HDFS DataNode may be able to craft a block token that grants unauthorized read access to random files by guessing certain fields in the token. Published: 2017-08-30T19:00:00.000Z Updated: 2024-09-16T19:51:02.745Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/94950 http://seclists.org/oss-sec/2016/q4/698 https://lists.apache.org/thread.html/r66de86b9a608c1da70b2d27d765c11ec88edf6e5dd6f379ab33e072a%40%3Cuser.flink.apache.org%3E	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-3086`	vulnerable	2026-06-08 05:07:44.354255	Details available The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for credential store provider used by the NodeManager to YARN Applications. Published: 2017-09-05T13:00:00.000Z Updated: 2024-09-16T17:13:54.507Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/95335 http://mail-archives.apache.org/mod_mbox/hadoop-general/201701.mbox/%3C0ed32746-5a53-9051-5877-2b1abd88beb6%40apache.org%3E	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.