{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ea4b850b-0e35-552f-893d-a7ec0a98ae9a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "hadoop-common", "purl": "pkg:maven/org.apache.hadoop/hadoop-common@2.6.0-tuxcare.1", "type": "library", "group": "org.apache.hadoop", "bom-ref": "pkg:maven/org.apache.hadoop/hadoop-common@2.6.0-tuxcare.1", "version": "2.6.0-tuxcare.1", "pedigree": { "ancestors": [ { "name": "hadoop-common", "purl": "pkg:maven/org.apache.hadoop/hadoop-common@2.6.0", "type": "library", "group": "org.apache.hadoop", "version": "2.6.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2013-2192", "affects": [ { "ref": "pkg:maven/org.apache.hadoop/hadoop-common@2.6.0-tuxcare.1" } ], "bom-ref": "urn:uuid:00e3e687-a0af-5ef4-a686-efbc2e44df7f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-2192 does not affect version 2.6.0-tuxcare.1 of org.apache.hadoop:hadoop-common. not_affected \u2014 The target (Apache Hadoop 2.6.0) is not affected by CVE-2013-2192. The upstream vendor's fix for this vulnerability was already present in the 2.6.0 release before TuxCare onboarding. The fix, authored by Aaron Myers (atm@apache.org) on June 19, 2013, introduces a configuration flag 'ipc.client.fallback-to-simple-auth-allowed' (default: false) that prevents clients from accepting server-initiat...", "justification": "code_not_present" } }, { "id": "CVE-2014-0229", "affects": [ { "ref": "pkg:maven/org.apache.hadoop/hadoop-common@2.6.0-tuxcare.1" } ], "bom-ref": "urn:uuid:e424b0a9-ddeb-5cd5-9fd3-bf12e9e5089e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0229 does not affect version 2.6.0-tuxcare.1 of org.apache.hadoop:hadoop-common. not_affected \u2014 Apache Hadoop 2.6.0 is not affected by CVE-2014-0229. The vulnerability affects Hadoop 2.x before 2.4.1, and version 2.6.0 already contains the upstream fix. The fix (adding checkSuperuserPrivilege() authorization checks to refreshNamenodes, deleteBlockPool, and shutdownDatanode methods) was authored by Kihwal Lee (kihwal@apache.org) on 2014-05-31 in commit 2655f418b217718f322dfe1b2c6a5a8b11e8f...", "justification": "code_not_present" } }, { "id": "CVE-2015-1776", "affects": [ { "ref": "pkg:maven/org.apache.hadoop/hadoop-common@2.6.0-tuxcare.1" } ], "bom-ref": "urn:uuid:db03ae2d-685b-5674-a2a4-02023fc13045", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-1776 affects version 2.6.0-tuxcare.1 of org.apache.hadoop:hadoop-common." } }, { "id": "CVE-2016-5001", "affects": [ { "ref": "pkg:maven/org.apache.hadoop/hadoop-common@2.6.0-tuxcare.1" } ], "bom-ref": "urn:uuid:c3f602a7-b83e-54b9-9775-99e5f29e3a14", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5001 affects version 2.6.0-tuxcare.1 of org.apache.hadoop:hadoop-common." } }, { "id": "CVE-2016-5393", "affects": [ { "ref": "pkg:maven/org.apache.hadoop/hadoop-common@2.6.0-tuxcare.1" } ], "bom-ref": "urn:uuid:50df201a-064a-509c-8023-8b1b1b248ef2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5393 affects version 2.6.0-tuxcare.1 of org.apache.hadoop:hadoop-common." } }, { "id": "CVE-2016-6811", "affects": [ { "ref": "pkg:maven/org.apache.hadoop/hadoop-common@2.6.0-tuxcare.1" } ], "bom-ref": "urn:uuid:5ade4587-634e-5f1f-8979-ed3806a2439a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-6811 affects version 2.6.0-tuxcare.1 of org.apache.hadoop:hadoop-common." } }, { "id": "CVE-2017-7669", "affects": [ { "ref": "pkg:maven/org.apache.hadoop/hadoop-common@2.6.0-tuxcare.1" } ], "bom-ref": "urn:uuid:dc05a5ef-bdef-5112-9620-10b9f0929d80", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7669 affects version 2.6.0-tuxcare.1 of org.apache.hadoop:hadoop-common." } }, { "id": "CVE-2020-9492", "affects": [ { "ref": "pkg:maven/org.apache.hadoop/hadoop-common@2.6.0-tuxcare.1" } ], "bom-ref": "urn:uuid:89d35704-affd-5c2a-936b-dcdb0764a77e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-9492 affects version 2.6.0-tuxcare.1 of org.apache.hadoop:hadoop-common." } }, { "id": "CVE-2021-37404", "affects": [ { "ref": "pkg:maven/org.apache.hadoop/hadoop-common@2.6.0-tuxcare.1" } ], "bom-ref": "urn:uuid:4ef1d039-7514-5cc1-8e2f-6ae94cda21d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-37404 affects version 2.6.0-tuxcare.1 of org.apache.hadoop:hadoop-common." } }, { "id": "CVE-2022-25168", "affects": [ { "ref": "pkg:maven/org.apache.hadoop/hadoop-common@2.6.0-tuxcare.1" } ], "bom-ref": "urn:uuid:13909e6a-6709-5922-904a-6833c3591dff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25168 affects version 2.6.0-tuxcare.1 of org.apache.hadoop:hadoop-common." } }, { "id": "CVE-2022-26612", "affects": [ { "ref": "pkg:maven/org.apache.hadoop/hadoop-common@2.6.0-tuxcare.1" } ], "bom-ref": "urn:uuid:c92d4c1c-9f1b-581f-9e2f-98bee0b2dbfb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-26612 affects version 2.6.0-tuxcare.1 of org.apache.hadoop:hadoop-common." } }, { "id": "CVE-2024-23454", "affects": [ { "ref": "pkg:maven/org.apache.hadoop/hadoop-common@2.6.0-tuxcare.1" } ], "bom-ref": "urn:uuid:af5aefdb-b7a4-5dca-a701-ede6a7f763bd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23454 affects version 2.6.0-tuxcare.1 of org.apache.hadoop:hadoop-common." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.hadoop/hadoop-common@2.6.0-tuxcare.1" } ] }