An update for hadoop is now available for openEuler-22.03-LTS-SP1 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2025-1038 Final 1.0 1.0 2025-01-10 Initial 2025-01-10 2025-01-10 openEuler SA Tool V1.0 2025-01-10 hadoop security update An update for hadoop is now available for openEuler-22.03-LTS-SP1 Apache Hadoop is a framework that allows for the distributed processing of large data sets across clusters of computers using simple programming models. It is designed to scale up from single servers to thousands of machines, each offering local computation and storage. Security Fix(es): Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local users. As such, files written in this directory, without setting the correct posix permissions explicitly, may be viewable by all other local users.(CVE-2024-23454) An update for hadoop is now available for openEuler-22.03-LTS-SP1. openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Medium hadoop https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1038 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-23454 https://nvd.nist.gov/vuln/detail/CVE-2024-23454 openEuler-22.03-LTS-SP1 hadoop-3.3.4-4.oe2203sp1.src.rpm hadoop-client-3.3.4-4.oe2203sp1.noarch.rpm hadoop-common-3.3.4-4.oe2203sp1.noarch.rpm hadoop-hdfs-3.3.4-4.oe2203sp1.noarch.rpm hadoop-httpfs-3.3.4-4.oe2203sp1.noarch.rpm hadoop-mapreduce-3.3.4-4.oe2203sp1.noarch.rpm hadoop-mapreduce-examples-3.3.4-4.oe2203sp1.noarch.rpm hadoop-maven-plugin-3.3.4-4.oe2203sp1.noarch.rpm hadoop-tests-3.3.4-4.oe2203sp1.noarch.rpm hadoop-yarn-3.3.4-4.oe2203sp1.noarch.rpm hadoop-common-native-3.3.4-4.oe2203sp1.aarch64.rpm hadoop-debuginfo-3.3.4-4.oe2203sp1.aarch64.rpm hadoop-debugsource-3.3.4-4.oe2203sp1.aarch64.rpm hadoop-devel-3.3.4-4.oe2203sp1.aarch64.rpm hadoop-yarn-security-3.3.4-4.oe2203sp1.aarch64.rpm libhdfs-3.3.4-4.oe2203sp1.aarch64.rpm hadoop-common-native-3.3.4-4.oe2203sp1.x86_64.rpm hadoop-debuginfo-3.3.4-4.oe2203sp1.x86_64.rpm hadoop-debugsource-3.3.4-4.oe2203sp1.x86_64.rpm hadoop-devel-3.3.4-4.oe2203sp1.x86_64.rpm hadoop-yarn-security-3.3.4-4.oe2203sp1.x86_64.rpm libhdfs-3.3.4-4.oe2203sp1.x86_64.rpm Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local users. As such, files written in this directory, without setting the correct posix permissions explicitly, may be viewable by all other local users. 2025-01-10 CVE-2024-23454 openEuler-22.03-LTS-SP1 Medium 6.2 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N hadoop security update 2025-01-10 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1038