CVE-2018-11765: High severity apache hadoop vulnerability
In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication when Kerberos authentication is enabled and SPNEGO through HTTP is not enabled.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-11765?
CVE-2018-11765 is a vulnerability in Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5 where any users can access some servlets without authentication when Kerberos authentication is enabled and SPNEGO through HTTP is not enabled.
What is the severity of CVE-2018-11765?
The severity of CVE-2018-11765 is high with a severity value of 7.5.
How does CVE-2018-11765 affect Apache Hadoop?
CVE-2018-11765 affects Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5.
How can I fix CVE-2018-11765 in Apache Hadoop?
To fix CVE-2018-11765 in Apache Hadoop, users should enable SPNEGO through HTTP when Kerberos authentication is enabled.
Is there any reference material available for CVE-2018-11765?
Yes, reference material for CVE-2018-11765 can be found at the following links: [Link 1](https://lists.apache.org/thread.html/r17d94d132b207dad221595fd8b8b18628f5f5ec7e3f5be939ecd8928@%3Ccommits.druid.apache.org%3E), [Link 2](https://lists.apache.org/thread.html/r2c7f899911a04164ed1707083fcd4135f8427e04778c87d83509b0da%40%3Cgeneral.hadoop.apache.org%3E), [Link 3](https://lists.apache.org/thread.html/r46447f38ea8c89421614e9efd7de5e656186d35e10fc97cf88477a01@%3Ccommits.druid.apache.org%3E).