CVE-2024-23454: Apache Hadoop: Temporary File Local Information Disclosure
Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local users. As such, files written in this directory, without setting the correct posix permissions explicitly, may be viewable by all other local users.
Other sources
Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local users. As such, files written in this directory, without setting the correct posix permissions explicitly, may be viewable by all other local users.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.hadoop:hadoop-commonto a version that resolves this vulnerability.Fixed in 3.4.0
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23454?
CVE-2024-23454 is considered a medium severity vulnerability due to its potential impact on sensitive data exposure.
How do I fix CVE-2024-23454?
To fix CVE-2024-23454, update Apache Hadoop to version 3.4.0 or later and ensure proper permissions are set for temporary directories.
What systems are affected by CVE-2024-23454?
CVE-2024-23454 affects Unix-like systems where Apache Hadoop is deployed and the `RunJar.run()` method is used.
What data is at risk with CVE-2024-23454?
CVE-2024-23454 poses a risk of exposing sensitive data that may be written to the shared system temporary directory.
Is there a workaround for CVE-2024-23454?
A potential workaround for CVE-2024-23454 is to manually adjust the permissions of the temporary directory before running applications that utilize Hadoop.