High severity7.5NVD Advisory· Published Jun 5, 2017· Updated May 13, 2026
CVE-2017-7669
CVE-2017-7669
Description
In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.hadoop:hadoop-commonMaven | < 2.8.1 | 2.8.1 |
org.apache.hadoop:hadoop-commonMaven | >= 3.0.0-alpha1, < 3.0.0-alpha3 | 3.0.0-alpha3 |
Affected products
4- Apache Software Foundation/Apache Hadoopv5Range: 2.8.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- www.securityfocus.com/bid/98795nvdThird Party AdvisoryVDB EntryWEB
- github.com/advisories/GHSA-h24p-qwf4-84q8ghsaADVISORY
- mail-archives.apache.org/mod_mbox/hadoop-user/201706.mbox/%3C4A2FDA56-491B-4C2A-915F-C9D4A4BDB92A%40apache.org%3EnvdMailing ListVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2017-7669ghsaADVISORY
News mentions
0No linked articles in our index yet.