The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos security features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information by forcing a downgrade to simple authentication.
| Date Added | Due Date | Vulnerability Name | Required Action |
|---|---|---|---|
| N/A |
| Type | Version | Base score | Base severity | Vector |
|---|---|---|---|---|
| Primary | 2.0 | 3.2 | LOW | AV:A/AC:H/Au:N/C:P/I:P/A:N |
| Hyperlink | Source | Resource |
|---|---|---|
| http://rhn.redhat.com/errata/RHSA-2014-0037.html | secalert@redhat.com | N/A |
| http://rhn.redhat.com/errata/RHSA-2014-0400.html | secalert@redhat.com | N/A |
| http://seclists.org/fulldisclosure/2013/Aug/251 | secalert@redhat.com | N/A |
| http://secunia.com/advisories/57915 | secalert@redhat.com | N/A |
| https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html | secalert@redhat.com | N/A |
| http://rhn.redhat.com/errata/RHSA-2014-0037.html | af854a3a-2127-422b-91ae-364da2661108 | N/A |
| http://rhn.redhat.com/errata/RHSA-2014-0400.html | af854a3a-2127-422b-91ae-364da2661108 | N/A |
| http://seclists.org/fulldisclosure/2013/Aug/251 | af854a3a-2127-422b-91ae-364da2661108 | N/A |
| http://secunia.com/advisories/57915 | af854a3a-2127-422b-91ae-364da2661108 | N/A |
| https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html | af854a3a-2127-422b-91ae-364da2661108 | N/A |