CVE-2021-25642

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

ZKConfigurationStore which is optionally used by CapacityScheduler of Apache Hadoop YARN deserializes data obtained from ZooKeeper without validation. An attacker having access to ZooKeeper can run arbitrary commands as YARN user by exploiting this. Users should upgrade to Apache Hadoop 2.10.2, 3.2.4, 3.3.4 or later (containing YARN-11126) if ZKConfigurationStore is used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Hadoop	2.9.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.3, and 3.3.0 to 3.3.3

References

https://lists.apache.org/thread/g6vf2h4wdgzzdgk91mqozhs58wotq150Mailing List, Vendor Advisory
https://security.netapp.com/advisory/ntap-20221201-0003/Third Party Advisory
https://lists.apache.org/thread/g6vf2h4wdgzzdgk91mqozhs58wotq150Mailing List, Vendor Advisory
https://security.netapp.com/advisory/ntap-20221201-0003/Third Party Advisory

Timeline

Published: Aug 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-256434.9An issue was discovered in Couchbase Server 5.x and 6.x before 6.5.2 and 6.6.x before 6.6.2. Internal users with administrator privileges, @CVE-2021-256447.5An issue was discovered in Couchbase Server 5.x and 6.x through 6.6.1 and 7.0.0 Beta. Incorrect commands to the REST API can result in leake CVE-2021-256454.4An issue was discovered in Couchbase Server before 6.0.5, 6.1.x through 6.5.x before 6.5.2, and 6.6.x before 6.6.1. An internal user with ad CVE-2021-256468.8Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is inte CVE-2021-256475.4Mobile application "Testes de Codigo" v11.3 and prior allows stored XSS by injecting a payload in the "feedback" message field causing it to CVE-2021-256489.8Mobile application "Testes de Codigo" 11.4 and prior allows an attacker to gain access to the administrative interface and premium features CVE-2021-256495.5An information disclosure vulnerability was discovered in the directory and file management of Avaya Aura Utility Services. This vulnerabili CVE-2021-256508.8A privilege escalation vulnerability was discovered in Avaya Aura Utility Services that may potentially allow a local user to execute specia CVE-2021-256517.8A privilege escalation vulnerability was discovered in Avaya Aura Utility Services that may potentially allow a local user to escalate privi CVE-2021-256525.5An information disclosure vulnerability was discovered in the directory and file management of Avaya Aura Appliance Virtualization Platform CVE-2021-256537.8A privilege escalation vulnerability was discovered in Avaya Aura Appliance Virtualization Platform Utilities (AVPU) that may potentially al CVE-2021-256547.8An arbitrary code execution vulnerability was discovered in Avaya Aura Device Services that may potentially allow a local user to execute sp