VYPR
← All advisories
High severity8.8NVD Advisory· Published Jan 26, 2021· Updated Jun 17, 2026

CVE-2020-9492

CVE-2020-9492

Description

In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without proper verification.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.hadoop:hadoop-commonMaven
>= 3.2.0, < 3.2.23.2.2
org.apache.hadoop:hadoop-commonMaven
>= 3.0.0, < 3.1.43.1.4
org.apache.hadoop:hadoop-commonMaven
>= 2.0.0, < 2.10.12.10.1

Affected products

8
  • Apache/Hadoop
    cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*
    Range: >=2.0.0,<=2.10.0
  • Apache/Solr2 versions
    cpe:2.3:a:apache:solr:8.6.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:apache:solr:8.6.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:solr:8.6.2:*:*:*:*:*:*:*
  • Oracle Corporation/Financial Services Crime And Compliance Management Studio2 versions
    cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:*
  • Apache/Hadoopdescription
  • osv-coords2 versions
    pkg:bitnami/solrpkg:maven/org.apache.hadoop/hadoop-common
    >= 8.6.0, < 8.6.1+ 1 more
    • (no CPE)range: >= 8.6.0, < 8.6.1
    • (no CPE)range: >= 3.2.0, < 3.2.2

Patches

Vulnerability mechanics

References

33

News mentions

0

No linked articles in our index yet.