CVE-2021-25642: Apache Hadoop YARN remote code execution in ZKConfigurationStore of capacity scheduler
ZKConfigurationStore which is optionally used by CapacityScheduler of Apache Hadoop YARN deserializes data obtained from ZooKeeper without validation. An attacker having access to ZooKeeper can run arbitrary commands as YARN user by exploiting this. Users should upgrade to Apache Hadoop 2.10.2, 3.2.4, 3.3.4 or later (containing YARN-11126) if ZKConfigurationStore is used.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-25642?
CVE-2021-25642 is a vulnerability in Apache Hadoop YARN that allows an attacker with access to ZooKeeper to run arbitrary commands as the YARN user.
How does CVE-2021-25642 impact Apache Hadoop?
CVE-2021-25642 impacts Apache Hadoop by allowing an attacker to execute arbitrary commands as the YARN user.
What is the severity of CVE-2021-25642?
CVE-2021-25642 has a severity rating of 8.8, which is considered high.
How can I fix CVE-2021-25642?
To fix CVE-2021-25642, users should upgrade to Apache Hadoop 2.10.2, 3.2.4, or 3.3.4.
Where can I find more information about CVE-2021-25642?
More information about CVE-2021-25642 can be found at the following references: <ul><li><a href='https://lists.apache.org/thread/g6vf2h4wdgzzdgk91mqozhs58wotq150'>https://lists.apache.org/thread/g6vf2h4wdgzzdgk91mqozhs58wotq150</a></li><li><a href='https://security.netapp.com/advisory/ntap-20221201-0003/'>https://security.netapp.com/advisory/ntap-20221201-0003/</a></li></ul>