CVE-2012-3376 json
Client BlockTokens not checked in Apache Hadoop
published 2012-07-12 14 y ago modified 2026-06-16 4 mo ago also GHSA-qmh2-h7r6-gm6q , EUVD-2022-5000
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.6%
- EPSS 2.6% chance of exploitation in 30 days, percentile 85%
- public exploits
- 0
- none known
Summary
DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have read access, and have other unspecified impacts.
Patch / fix
- maven org.apache.hadoop:hadoop-client 2.0.1-alpha
Exploit prediction
2.63% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.hadoop:hadoop-client | >=2.0.0-alpha, <2.0.1-alpha |
2.0.1-alpha |
Classification
- Weakness
-
- CWE-310 Cryptographic Issues
References
-
cloudera.com
/documentation/other/security-bulletins/topics/csb_topic_1.html
web
-
archives.neohapsis.com
/archives/bugtraq/2012-07/0049.html
mailing-list, web
-
securityfocus.com
/bid/54358
vdb-entry
-
nvd.nist.gov
/vuln/detail/CVE-2012-3376
advisory
-
github.com
/apache/hadoop
package
-
seclists.org
/fulldisclosure/2012/Jul/78
web
Sources
- CVE List CVE-2012-3376
- GitHub Advisory GHSA-qmh2-h7r6-gm6q
- NVD CVE-2012-3376
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.