CVE-2024-23454: apache hadoop

csirt@kutim:~/threat-intel/cve/CVE-2024-23454

CVSS 6.2 · Medium EPSS 0,41%

Kerentanan Creation of Temporary File With Insecure Permissions pada apache hadoop. Skor CVSS 3.1 6.2 (Medium) menurut CISA ADP.

Deskripsi (NVD)

Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local users. As such, files written in this directory, without setting the correct posix permissions explicitly, may be viewable by all other local users.

Rincian

Terbit di NVD: 25 September 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 6.2 (Medium), sumber CISA ADP
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-378: Creation of Temporary File With Insecure Permissions
EPSS (30 hari): 0,41% peluang dieksploitasi; lebih tinggi dari 33,1% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
apache	hadoop	Semua versi sebelum 3.4.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://issues.apache.org/jira/browse/HADOOP-19031 patch · advisory vendor
https://lists.apache.org/thread/xlo7q8kn4tsjvx059r789oz19hzgfkfs mailing list · advisory vendor
http://www.openwall.com/lists/oss-security/2024/09/25/1 mailing list · advisory pihak ketiga
https://security.netapp.com/advisory/ntap-20241101-0002/ advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.