{"id":"CVE-2017-7669","aliases":["EUVD-2022-4041","GHSA-h24p-qwf4-84q8"],"status":"published","title":"Apache Hadoop's LinuxContainerExecutor runs docker commands as root with insufficient input validation","description":"In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01795,"percentile":0.78574,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2017-06-02T17:00:00Z","modified":"2026-10-24T10:30:18Z","fixes":[{"ecosystem":"Maven","package":"org.apache.hadoop:hadoop-common","fixed_in":["2.8.1","3.0.0-alpha3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.hadoop:hadoop-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.1"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.hadoop:hadoop-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0-alpha1"},{"fixed":"3.0.0-alpha3"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.hadoop:hadoop-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.1"}]}],"versions":["0.22.0","0.23.1","0.23.10","0.23.11","0.23.3","0.23.4","0.23.5","0.23.6","0.23.7","0.23.8","0.23.9","2.0.0-alpha","2.0.1-alpha","2.0.2-alpha","2.0.3-alpha","2.0.4-alpha","2.0.5-alpha","2.0.6-alpha","2.1.0-beta","2.1.1-beta","2.2.0","2.3.0","2.4.0","2.4.1","2.5.0","2.5.1","2.5.2","2.6.0","2.6.1","2.6.2","2.6.3","2.6.4","2.6.5","2.7.0","2.7.1","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.8.0"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.hadoop:hadoop-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0-alpha1"},{"fixed":"3.0.0-alpha3"}]}],"versions":["3.0.0-alpha1","3.0.0-alpha2"]}],"products":[{"vendor":"apache","product":"hadoop"},{"vendor":"apache software foundation","product":"apache hadoop"}],"references":[{"url":"http://www.securityfocus.com/bid/98795","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://mail-archives.apache.org/mod_mbox/hadoop-user/201706.mbox/%3C4A2FDA56-491B-4C2A-915F-C9D4A4BDB92A%40apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7669","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-h24p-qwf4-84q8"}],"sources":{"cve":[{"id":"CVE-2017-7669","description":"In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root.","status":"published","published":"2017-06-02T17:00:00Z","modified":"2024-08-05T16:12:27.98Z","updated_at":"2026-11-02T14:33:20.488433Z"}],"euvd":[{"id":"EUVD-2022-4041","description":"In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root.","status":"published","published":"2017-06-02T17:00:00Z","modified":"2024-08-05T16:12:27Z","updated_at":"2026-11-03T02:39:07.559484Z"}],"ghsa":[{"id":"GHSA-h24p-qwf4-84q8","title":"Apache Hadoop's LinuxContainerExecutor runs docker commands as root with insufficient input validation","description":"In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root. This issue is fixed in versions 2.8.1 and 3.0.0-alpha3.","status":"published","published":"2022-05-17T02:41:57Z","modified":"2023-02-02T05:03:23Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:36:40.500292Z"}],"nvd":[{"id":"CVE-2017-7669","description":"In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root.","status":"published","published":"2017-06-05T01:29:00.537Z","modified":"2026-06-17T01:24:56.463Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":8.5,"vector":"AV:N/AC:M/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:49.449157Z"}],"osv":[{"id":"CVE-2017-7669","description":"In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root.","status":"published","published":"2017-06-05T01:29:00.537Z","modified":"2026-10-24T10:30:18.687591623Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:06.412595Z"},{"id":"GHSA-h24p-qwf4-84q8","title":"Apache Hadoop's LinuxContainerExecutor runs docker commands as root with insufficient input validation","description":"In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root. This issue is fixed in versions 2.8.1 and 3.0.0-alpha3.","status":"published","published":"2022-05-17T02:41:57Z","modified":"2023-11-08T03:59:26.035253Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:48.546324Z"}]}}