CVE-2012-3376
Client BlockTokens not checked in Apache Hadoop
CVE-2012-3376 is a high vulnerability (CVSS 7.5) in Apache Hadoop, published July 12, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.63%, the 85th percentile. Fixed in org.apache.hadoop:hadoop-client 2.0.1-alpha.
DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have read access, and have other unspecified impacts.
Exploit likelihood
What each source reports
NVD Score used
DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have read access, and have other unspecified impacts.
- Record
CVE-2012-3376- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have read access, and have other unspecified impacts.
- Record
CVE-2012-3376- Updated
- 2026-11-02
EUVDEUVD-2022-5000 No score
DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have read access, and have other unspecified impacts.
- Record
EUVD-2022-5000- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qmh2-h7r6-gm6q No score
Client BlockTokens not checked in Apache Hadoop
DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have read access, and have other unspecified impacts.
- Record
GHSA-qmh2-h7r6-gm6q- Updated
- 2026-11-02
OSVGHSA-qmh2-h7r6-gm6q No score
Client BlockTokens not checked in Apache Hadoop
DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have read access, and have other unspecified impacts.
- Record
GHSA-qmh2-h7r6-gm6q- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.hadoop:hadoop-clientMaven |
2.0.0-alpha to 2.0.0-alpha | 2.0.1-alpha |
org.apache.hadoop:hadoop-clientMaven |
2.0.0-alpha up to 2.0.1-alpha | 2.0.1-alpha |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html
archives.neohapsis.com/archives/bugtraq/2012-07/0049.html
securityfocus.com/bid/54358
nvd.nist.gov/vuln/detail/CVE-2012-3376
seclists.org/fulldisclosure/2012/Jul/78
github.com/advisories/GHSA-qmh2-h7r6-gm6q