CVE-2014-3627
Improper Link Resolution Before File Access in Apache Hadoop
The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote cluster users to change the permissions of certain files to world-readable via a symlink attack in a public tar archive, which is not properly handled during localization, related to distributed cache.
Exploit likelihood
What each source reports
NVD Score used
The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote cluster users to change the permissions of certain files to world-readable via a symlink attack in a public tar archive, which is not properly handled during localization, related to distributed cache.
- Record
CVE-2014-3627- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-59
- Updated
- 2026-11-02
CVE List No score
The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote cluster users to change the permissions of certain files to world-readable via a symlink attack in a public tar archive, which is not properly handled during localization, related to distributed cache.
- Record
CVE-2014-3627- Updated
- 2026-11-02
EUVDEUVD-2022-4410 No score
The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote cluster users to change the permissions of certain files to world-readable via a symlink attack in a public tar archive, which is not properly handled during localization, related to distributed cache.
- Record
EUVD-2022-4410- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jpmf-8cj2-595g No score
Improper Link Resolution Before File Access in Apache Hadoop
The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote cluster users to change the permissions of certain files to world-readable via a symlink attack in a public tar archive, which is not properly handled during localization, related to distributed cache.
- Record
GHSA-jpmf-8cj2-595g- Weakness
- CWE-59
- Updated
- 2026-11-02
OSVGHSA-jpmf-8cj2-595g No score
Improper Link Resolution Before File Access in Apache Hadoop
The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote cluster users to change the permissions of certain files to world-readable via a symlink attack in a public tar archive, which is not properly handled during localization, related to distributed cache.
- Record
GHSA-jpmf-8cj2-595g- Weakness
- CWE-59
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.hadoop:hadoop-clientMaven |
0.23.0 up to 1.0.1 | 1.0.1 |
org.apache.hadoop:hadoop-clientMaven |
2.0.0 up to 2.5.2 | 2.5.2 |
org.apache.hadoop:hadoop-clientMaven |
0.23.0 up to 1.0.1, plus listed versions 0.23.10.23.100.23.110.23.30.23.4 Show 5 moreShow less0.23.50.23.60.23.70.23.80.23.9 |
1.0.1 |
org.apache.hadoop:hadoop-clientMaven |
2.0.0 up to 2.5.2, plus listed versions 2.0.1-alpha2.0.2-alpha2.0.3-alpha2.0.4-alpha2.0.5-alpha Show 9 moreShow less2.0.6-alpha2.1.0-beta2.1.1-beta2.2.02.3.02.4.02.4.12.5.02.5.1 |
2.5.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-3627 is a medium vulnerability (CVSS 5.0) in Apache Hadoop, published December 5, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.00%, the 87th percentile. Fixed in org.apache.hadoop:hadoop-client 1.0.1.
References
mail-archives.apache.org/mod_mbox/hadoop-general/201411.mbox/%3CCALwhT97dOi04aC3VbekaB+zn2UAS_OZV2EAiP78GmjnMzfp2Ug%40mail.gmail.com%3E
secunia.com/advisories/60079
nvd.nist.gov/vuln/detail/CVE-2014-3627
github.com/advisories/GHSA-jpmf-8cj2-595g