VYPR
← All advisories
High severity8.8NVD Advisory· Published Jun 15, 2022· Updated Jun 17, 2026

CVE-2021-33036

CVE-2021-33036

Description

In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.hadoop:hadoop-yarn-server-commonMaven
>= 2.2.0, < 2.10.22.10.2
org.apache.hadoop:hadoop-yarn-server-commonMaven
>= 3.0.0, < 3.2.33.2.3
org.apache.hadoop:hadoop-yarn-server-commonMaven
>= 3.3.0, < 3.3.23.3.2

Affected products

7
  • Apache/Hadoop5 versions
    cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*+ 4 more
    • cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*range: >=2.2.0,<2.10.2
    • cpe:2.3:a:apache:hadoop:3.0.0:alpha1:*:*:*:*:*:*
    • cpe:2.3:a:apache:hadoop:3.0.0:alpha2:*:*:*:*:*:*
    • cpe:2.3:a:apache:hadoop:3.0.0:alpha3:*:*:*:*:*:*
    • cpe:2.3:a:apache:hadoop:3.0.0:alpha4:*:*:*:*:*:*
  • ghsa-coords
    pkg:maven/org.apache.hadoop/hadoop-yarn-server-common
    Range: >= 2.2.0, < 2.10.2
  • Apache Software Foundation/Apache Hadoopv5
    Range: 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1

Patches

Vulnerability mechanics

References

9

News mentions

0

No linked articles in our index yet.