CVE-2021-33036: Apache Hadoop Privilege escalation vulnerability
Published Jun 15, 2022
·Updated
In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.
Affected Software
7 affected components
Apache Hadoop>=2.2.0<2.10.2
Apache Hadoop>=3.0.1<3.2.3
Apache Hadoop>=3.3.0<3.3.2
Apache Hadoop=3.0.0-alpha1
Apache Hadoop=3.0.0-alpha2
Apache Hadoop=3.0.0-alpha3
Apache Hadoop=3.0.0-alpha4
Event History
Jun 15, 2022
CVE Published
via MITRE·02:25 PM
Data Sourced
via MITRE·02:25 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this Apache Hadoop vulnerability?
The vulnerability ID for this Apache Hadoop vulnerability is CVE-2021-33036.
2
What is the severity of CVE-2021-33036?
The severity of CVE-2021-33036 is critical with a score of 8.8.
3
Which versions of Apache Hadoop are affected by CVE-2021-33036?
Apache Hadoop versions 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1 are affected by CVE-2021-33036.
4
How can a user exploit CVE-2021-33036?
A user who can escalate to yarn user can possibly run arbitrary commands as root user.
5
How can the Apache Hadoop vulnerability CVE-2021-33036 be mitigated?
Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.