CVE-2015-1776: Infoleak
Apache Hadoop 2.6.x encrypts intermediate data generated by a MapReduce job and stores it along with the encryption key in a credentials file on disk when the Intermediate data encryption feature is enabled, which allows local users to obtain sensitive information by reading the file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-1776?
CVE-2015-1776 is considered a medium severity vulnerability due to its potential to expose sensitive information.
How do I fix CVE-2015-1776?
To fix CVE-2015-1776, update Apache Hadoop to a version later than 2.6.4 where this vulnerability is addressed.
Who is affected by CVE-2015-1776?
Apache Hadoop versions 2.6.0 to 2.6.4 are affected by CVE-2015-1776, impacting local users who can access the credentials file.
What type of information can be exposed due to CVE-2015-1776?
CVE-2015-1776 can expose sensitive data such as encryption keys stored in the credentials file on disk.
What feature in Apache Hadoop is related to CVE-2015-1776?
CVE-2015-1776 is related to the Intermediate data encryption feature in Apache Hadoop that improperly handles encryption key storage.