{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:56a1da18-655f-55b3-8303-ea783db1178d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "hadoop-main", "purl": "pkg:maven/org.apache.hadoop/hadoop-main@2.6.0-tuxcare.1", "type": "library", "group": "org.apache.hadoop", "bom-ref": "pkg:maven/org.apache.hadoop/hadoop-main@2.6.0-tuxcare.1", "version": "2.6.0-tuxcare.1", "pedigree": { "ancestors": [ { "name": "hadoop-main", "purl": "pkg:maven/org.apache.hadoop/hadoop-main@2.6.0", "type": "library", "group": "org.apache.hadoop", "version": "2.6.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2012-1574", "affects": [ { "ref": "pkg:maven/org.apache.hadoop/hadoop-main@2.6.0-tuxcare.1" } ], "bom-ref": "urn:uuid:0aeb48e7-c4f4-52e4-9c81-7f1ab10c0d34", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2012-1574 does not affect version 2.6.0-tuxcare.1 of org.apache.hadoop:hadoop-main. not_affected \u2014 CVE-2012-1574 affects Hadoop versions 0.20.x, 0.23.x before 0.23.2, and 1.0.x before 1.0.2. The target version 2.6.0 is not affected because it includes server-side user identity validation that prevents impersonation. The ClientRMService extracts the authenticated user from UserGroupInformation.getCurrentUser() at line 538, ensuring the job owner is the actual authenticated user, not a client-...", "justification": "protected_at_runtime" } }, { "id": "CVE-2012-2945", "affects": [ { "ref": "pkg:maven/org.apache.hadoop/hadoop-main@2.6.0-tuxcare.1" } ], "bom-ref": "urn:uuid:916fa0a5-6e24-56d7-8ded-df1da1bf1793", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-2945 affects version 2.6.0-tuxcare.1 of org.apache.hadoop:hadoop-main." } }, { "id": "CVE-2017-15713", "affects": [ { "ref": "pkg:maven/org.apache.hadoop/hadoop-main@2.6.0-tuxcare.1" } ], "bom-ref": "urn:uuid:7a6bd4fa-441b-507c-862e-8dfc616029e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-15713 affects version 2.6.0-tuxcare.1 of org.apache.hadoop:hadoop-main." } }, { "id": "CVE-2017-15718", "affects": [ { "ref": "pkg:maven/org.apache.hadoop/hadoop-main@2.6.0-tuxcare.1" } ], "bom-ref": "urn:uuid:83f6e6ff-0caf-5919-8551-4a2a42d23174", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-15718 affects version 2.6.0-tuxcare.1 of org.apache.hadoop:hadoop-main." } }, { "id": "CVE-2017-3166", "affects": [ { "ref": "pkg:maven/org.apache.hadoop/hadoop-main@2.6.0-tuxcare.1" } ], "bom-ref": "urn:uuid:645f6261-2cd1-547a-b83c-66f1b44ea69a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-3166 affects version 2.6.0-tuxcare.1 of org.apache.hadoop:hadoop-main." } }, { "id": "CVE-2018-11764", "affects": [ { "ref": "pkg:maven/org.apache.hadoop/hadoop-main@2.6.0-tuxcare.1" } ], "bom-ref": "urn:uuid:aa626e2a-3d4f-561e-84a2-fa43ce455137", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11764 does not affect version 2.6.0-tuxcare.1 of org.apache.hadoop:hadoop-main. not_affected \u2014 Apache Hadoop 2.6.0 is not affected by CVE-2018-11764. The CVE specifically affects versions 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0, where web endpoint authentication checks were broken. The target version (2.6.0) predates these affected versions and contains proper authorization checks via ProxyUsers.authorize() in all web authentication entry points (DelegationTokenAuthenticationFilter, Delegat...", "justification": "code_not_present" } }, { "id": "CVE-2018-11765", "affects": [ { "ref": "pkg:maven/org.apache.hadoop/hadoop-main@2.6.0-tuxcare.1" } ], "bom-ref": "urn:uuid:75193dec-b968-5501-ba21-d7deaa054692", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11765 does not affect version 2.6.0-tuxcare.1 of org.apache.hadoop:hadoop-main. Apache Hadoop 2.6.0 is NOT affected by CVE-2018-11765. The vulnerability affects only versions 2.8.0-2.8.5, 2.9.0-2.9.2, and 3.0.0-alpha2 to 3.0.0, all of which are NEWER than this target version. The vulnerable authentication bypass pattern (isStaticUserAndNoneAuthType method) introduced in HADOOP-13707 does not exist in version 2.6.0. All servlet endpoints in this version use proper authentication checks without any bypass logic.", "justification": "code_not_present" } }, { "id": "CVE-2018-11766", "affects": [ { "ref": "pkg:maven/org.apache.hadoop/hadoop-main@2.6.0-tuxcare.1" } ], "bom-ref": "urn:uuid:cb49fa19-1b7c-5902-aae9-383cf6792a47", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11766 affects version 2.6.0-tuxcare.1 of org.apache.hadoop:hadoop-main." } }, { "id": "CVE-2018-11767", "affects": [ { "ref": "pkg:maven/org.apache.hadoop/hadoop-main@2.6.0-tuxcare.1" } ], "bom-ref": "urn:uuid:2bc406f4-0160-5516-a91d-39894aaa54a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11767 affects version 2.6.0-tuxcare.1 of org.apache.hadoop:hadoop-main." } }, { "id": "CVE-2018-11768", "affects": [ { "ref": "pkg:maven/org.apache.hadoop/hadoop-main@2.6.0-tuxcare.1" } ], "bom-ref": "urn:uuid:4640fcdb-ac35-5855-b1d5-345bba527a55", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11768 affects version 2.6.0-tuxcare.1 of org.apache.hadoop:hadoop-main." } }, { "id": "CVE-2018-1296", "affects": [ { "ref": "pkg:maven/org.apache.hadoop/hadoop-main@2.6.0-tuxcare.1" } ], "bom-ref": "urn:uuid:cc8c0287-c331-5496-9b21-61432e0e3e75", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1296 affects version 2.6.0-tuxcare.1 of org.apache.hadoop:hadoop-main." } }, { "id": "CVE-2018-8009", "affects": [ { "ref": "pkg:maven/org.apache.hadoop/hadoop-main@2.6.0-tuxcare.1" } ], "bom-ref": "urn:uuid:c694f9ee-2115-5266-a0df-248bdbee8c05", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-8009 affects version 2.6.0-tuxcare.1 of org.apache.hadoop:hadoop-main." } }, { "id": "CVE-2018-8029", "affects": [ { "ref": "pkg:maven/org.apache.hadoop/hadoop-main@2.6.0-tuxcare.1" } ], "bom-ref": "urn:uuid:8ea036dd-e9d3-5b2a-acf7-0dc5517bee11", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-8029 affects version 2.6.0-tuxcare.1 of org.apache.hadoop:hadoop-main." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.hadoop/hadoop-main@2.6.0-tuxcare.1" } ] }