Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content.
This is because, on unix-like systems, the system temporary directory is
shared between all local users. As such, files written in this directory,
without setting the correct posix permissions explicitly, may be viewable
by all other local users.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2024/09/25/1 | Mailing List Third Party Advisory |
| https://issues.apache.org/jira/browse/HADOOP-19031 | Patch Vendor Advisory |
| https://lists.apache.org/thread/xlo7q8kn4tsjvx059r789oz19hzgfkfs | Mailing List Vendor Advisory |
| https://security.netapp.com/advisory/ntap-20241101-0002/ | Third Party Advisory |
Configurations
History
10 Jul 2025, 19:00
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:* | |
| First Time |
Apache hadoop
Apache |
|
| CWE | ||
| References |
|
|
| References | () https://issues.apache.org/jira/browse/HADOOP-19031 - Patch, Vendor Advisory | |
| References | () https://lists.apache.org/thread/xlo7q8kn4tsjvx059r789oz19hzgfkfs - Mailing List, Vendor Advisory |
25 Sep 2024, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-09-25 08:15
Updated : 2025-07-10 19:00
NVD link : CVE-2024-23454
Mitre link : CVE-2024-23454
JSON object : View
Products Affected
apache
- hadoop
CWE
No CWE.