CVE-2020-35451

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

There is a race condition in OozieSharelibCLI in Apache Oozie before version 5.2.1 which allows a malicious attacker to replace the files in Oozie's sharelib during it's creation.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-377 CWE-362

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Oozie	>= unspecified, < 5.2.1

References

http://www.openwall.com/lists/oss-security/2021/03/09/2Mailing List, Third Party Advisory
https://lists.apache.org/thread.html/r8688debdb8b586aab3e53dee2d675fc9212de0ec627a8d3cd43b5ab5%40%3Cuser.oozie.apache.org%3EMailing List, Vendor Advisory
https://lists.apache.org/thread.html/r8688debdb8b586aab3e53dee2d675fc9212de0ec627a8d3cd43b5ab5%40%3Cuser.oozie.apache.org%3EMailing List, Vendor Advisory
https://lists.apache.org/thread.html/r8688debdb8b586aab3e53dee2d675fc9212de0ec627a8d3cd43b5ab5%40%3Cuser.oozie.apache.org%3EMailing List, Vendor Advisory
https://lists.apache.org/thread.html/r8688debdb8b586aab3e53dee2d675fc9212de0ec627a8d3cd43b5ab5%40%3Cuser.oozie.apache.org%3EMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2021/03/09/2Mailing List, Third Party Advisory
https://lists.apache.org/thread.html/r8688debdb8b586aab3e53dee2d675fc9212de0ec627a8d3cd43b5ab5%40%3Cuser.oozie.apache.org%3EMailing List, Vendor Advisory
https://lists.apache.org/thread.html/r8688debdb8b586aab3e53dee2d675fc9212de0ec627a8d3cd43b5ab5%40%3Cuser.oozie.apache.org%3EMailing List, Vendor Advisory
https://lists.apache.org/thread.html/r8688debdb8b586aab3e53dee2d675fc9212de0ec627a8d3cd43b5ab5%40%3Cuser.oozie.apache.org%3EMailing List, Vendor Advisory
https://lists.apache.org/thread.html/r8688debdb8b586aab3e53dee2d675fc9212de0ec627a8d3cd43b5ab5%40%3Cuser.oozie.apache.org%3EMailing List, Vendor Advisory

Timeline

Published: Mar 9, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-354527.3Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no repo CVE-2020-354535.3HashiCorp Vault Enterprise’s Sentinel EGP policy feature incorrectly allowed requests to be processed in parent and sibling namespaces. Fixe CVE-2020-354546.8The Taidii Diibear Android application 2.4.0 and all its derivatives allow attackers to obtain user credentials from an Android backup becau CVE-2020-354557.8The Taidii Diibear Android application 2.4.0 and all its derivatives allow attackers to obtain user credentials from Shared Preferences and CVE-2020-354565.5The Taidii Diibear Android application 2.4.0 and all its derivatives allow attackers to view private chat messages and media files via logca CVE-2020-354577.8GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in g_option_group_add_entries. NOTE: the vendor CVE-2020-354589.8An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x. There is a Ruby shell code injection issue via the hawk_remember_me_id para CVE-2020-354597.8An issue was discovered in ClusterLabs crmsh through 4.2.1. Local attackers able to call "crm history" (when "crm" is run) were able to exec CVE-2020-35465.3A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) could allow an unau CVE-2020-354605.3common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writin CVE-2020-354629.8Version 3.16.0 of the CoScale agent Docker image contains a blank password for the root user. Systems deployed using affected versions of th CVE-2020-354639.8Version 1.0.0 of the Instana Dynamic APM Docker image contains a blank password for the root user. Systems deployed using affected versions