VYPR
← All advisories
High severity7.5NVD Advisory· Published Sep 30, 2020· Updated Jun 17, 2026

CVE-2018-11765

CVE-2018-11765

Description

In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication when Kerberos authentication is enabled and SPNEGO through HTTP is not enabled.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.hadoop:hadoop-mainMaven
>= 3.0.0-alpha2, < 3.0.13.0.1
org.apache.hadoop:hadoop-mainMaven
>= 2.9.0, < 2.9.32.9.3
org.apache.hadoop:hadoop-mainMaven
>= 2.8.0, < 2.8.62.8.6

Affected products

5
  • Apache/Hadoopdescription
  • Apache/Hadoop3 versions
    cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*range: >=2.8.0,<=2.8.5
    • cpe:2.3:a:apache:hadoop:3.0.0:-:*:*:*:*:*:*
    • cpe:2.3:a:apache:hadoop:3.0.0:alpha2:*:*:*:*:*:*
  • ghsa-coords
    pkg:maven/org.apache.hadoop/hadoop-main
    Range: >= 3.0.0-alpha2, < 3.0.1

Patches

Vulnerability mechanics

References

25

News mentions

0

No linked articles in our index yet.