CVE-2012-3376
Client BlockTokens not checked in Apache Hadoop
CVE-2012-3376 is a high vulnerability (CVSS 7.5) in Apache Hadoop, published July 12, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.63%, the 85th percentile. Fixed in org.apache.hadoop:hadoop-client 2.0.1-alpha.
- Severity
- 7.5 HighCVSS 2.0, NVD
- Exploit chance
- 2.63%EPSS, 85th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.0.1-alphaorg.apache.hadoop:hadoop-client +1 more
Description
DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have read access, and have other unspecified impacts.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.hadoop:hadoop-clientMaven | 2.0.0-alpha to 2.0.0-alpha | 2.0.1-alpha |
org.apache.hadoop:hadoop-clientMaven | 2.0.0-alpha up to 2.0.1-alpha | 2.0.1-alpha |
What each source reports
NVD Score used
DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have read access, and have other unspecified impacts.
- Record
CVE-2012-3376- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE ListNo score
DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have read access, and have other unspecified impacts.
- Record
CVE-2012-3376- Updated
- 2026-11-02
EUVDEUVD-2022-5000No score
DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have read access, and have other unspecified impacts.
- Record
EUVD-2022-5000- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qmh2-h7r6-gm6qNo score
Client BlockTokens not checked in Apache Hadoop
DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have read access, and have other unspecified impacts.
- Record
GHSA-qmh2-h7r6-gm6q- Updated
- 2026-11-02
OSVGHSA-qmh2-h7r6-gm6qNo score
Client BlockTokens not checked in Apache Hadoop
DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have read access, and have other unspecified impacts.
- Record
GHSA-qmh2-h7r6-gm6q- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html
archives.neohapsis.com/archives/bugtraq/2012-07/0049.html
securityfocus.com/bid/54358
nvd.nist.gov/vuln/detail/CVE-2012-3376
seclists.org/fulldisclosure/2012/Jul/78
github.com/advisories/GHSA-qmh2-h7r6-gm6q