VYPR
← All advisories
High severity8.8NVD Advisory· Published May 30, 2019· Updated Jun 17, 2026

CVE-2018-8029

CVE-2018-8029

Description

In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.hadoop:hadoop-mainMaven
>= 2.2.0, < 2.8.42.8.4
org.apache.hadoop:hadoop-mainMaven
>= 2.9.0, < 2.9.22.9.2
org.apache.hadoop:hadoop-mainMaven
>= 3.0.0, < 3.1.13.1.1

Affected products

11
  • Apache/Hadoopdescription
  • Apache/Hadoop9 versions
    cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*+ 8 more
    • cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*range: >=2.2.0,<=2.8.4
    • cpe:2.3:a:apache:hadoop:2.9.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:hadoop:2.9.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:hadoop:3.0.0:-:*:*:*:*:*:*
    • cpe:2.3:a:apache:hadoop:3.0.0:alpha1:*:*:*:*:*:*
    • cpe:2.3:a:apache:hadoop:3.0.0:alpha2:*:*:*:*:*:*
    • cpe:2.3:a:apache:hadoop:3.0.0:alpha3:*:*:*:*:*:*
    • cpe:2.3:a:apache:hadoop:3.0.0:alpha4:*:*:*:*:*:*
    • cpe:2.3:a:apache:hadoop:3.0.0:beta1:*:*:*:*:*:*
  • ghsa-coords
    pkg:maven/org.apache.hadoop/hadoop-main
    Range: >= 2.2.0, < 2.8.4

Patches

Vulnerability mechanics

References

17

News mentions

0

No linked articles in our index yet.