Access Control Issues in Apache Hadoop KMS for Specific User Groups

CVE-2018-11767

What is CVE-2018-11767?

Apache Hadoop versions 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, and 2.7.5 to 2.7.6 exhibit a vulnerability in the KMS (Key Management Server) where the access control lists (ACLs) do not function as intended when non-default group mapping mechanisms are employed. This may lead to unauthorized users gaining access or legitimate users being inadvertently blocked. This situation underscores the importance of validating group mappings in Hadoop environments to maintain robust security postures.

References