{"id":"CVE-2022-25168","summary":"Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTar","details":"Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It has been used in Hadoop 2.x for yarn localization, which does enable remote code execution. It is used in Apache Spark, from the SQL command ADD ARCHIVE. As the ADD ARCHIVE command adds new binaries to the classpath, being able to execute shell scripts does not confer new permissions to the caller. SPARK-38305. \"Check existence of file before untarring/zipping\", which is included in 3.3.0, 3.1.4, 3.2.2, prevents shell commands being executed, regardless of which version of the hadoop libraries are in use. Users should upgrade to Apache Hadoop 2.10.2, 3.2.4, 3.3.3 or upper (including HADOOP-18136).","aliases":["GHSA-8wm5-8h9c-47pc"],"modified":"2026-08-12T03:49:12.971131068Z","published":"2022-08-04T14:30:17Z","database_specific":{"cna_assigner":"apache","cwe_ids":["CWE-78"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/25xxx/CVE-2022-25168.json","unresolved_ranges":[{"extracted_events":[{"introduced":"2.0.0 to 2.10.1"},{"last_affected":"2.0.0 to 2.10.1"},{"introduced":"3.0.0-alpha to 3.2.3"},{"last_affected":"3.0.0-alpha to 3.2.3"},{"introduced":"3.3.0 to 3.3.2"},{"last_affected":"3.3.0 to 3.3.2"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"WEB","url":"https://lists.apache.org/thread/mxqnb39jfrwgs3j6phwvlrfq4mlox130"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/25xxx/CVE-2022-25168.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25168"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20220915-0007/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/hadoop","events":[{"introduced":"0"},{"last_affected":"1827467c9a56f133025f28557bfc2c562d78e816"},{"introduced":"c25427ceca461ee979d30edd7a4b0f50718e6533"},{"last_affected":"abe5358143720085498613d399be3bbf01e0f131"},{"introduced":"aa96f1871bfd858f9bac59cf2a81ec470da649af"},{"last_affected":"0bcb014209e219273cb6fd4152df7df713cbac61"},{"introduced":"6d9bbbf86ef1ede4b0c97e63ff4a6ea40806a860"},{"introduced":"f335d509d3a778f11265d3f45800dd6e75f7be59"},{"introduced":"2bde3aedf139368fc71f053d8dd6580b498ff46d"}],"database_specific":{"cpe":"cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"2.0.0"},{"last_affected":"2.10.1"},{"introduced":"3.0.0"},{"last_affected":"3.2.3"},{"introduced":"3.3.0"},{"last_affected":"3.3.2"}],"source":"CPE_RANGE"}}],"versions":["release-3.5.0-RC2","rel/release-3.5.0","release-3.5.0-RC1","release-3.5.0-RC0","release-3.4.3-RC1","rel/release-3.4.3","release-3.4.3-RC0","release-3.4.2-RC3","rel/release-3.4.2","release-3.4.2-RC2","release-3.4.2-RC1","release-3.4.1-RC3","rel/release-3.4.1","release-3.4.1-RC2","release-3.4.1-RC1","release-3.4.0-RC3","rel/release-3.4.0","release-3.4.0-RC2","release-3.4.0-RC1","release-3.4.0-RC0","release-3.3.6-RC1","rel/release-3.3.6","release-3.3.6-RC0","release-3.3.5-RC3","rel/release-3.3.5","release-3.3.5-RC2","release-3.3.5-RC1","release-3.3.5-RC0","release-3.2.4-RC0","rel/release-3.2.4","release-2.10.2-RC0","rel/release-2.10.2","release-3.2.3-RC1","rel/release-3.2.3","release-3.2.3-RC0","release-3.3.2-RC5","release-3.3.2-RC4","rel/release-3.3.2","release-3.3.2-RC3","release-3.3.2-RC2","release-3.3.2-RC1","release-3.3.2-RC0","release-3.3.1-RC3","rel/release-3.3.1","release-3.3.1-RC2","release-3.3.1-RC1","release-3.3.1-RC0","release-3.2.2-RC5","rel/release-3.2.2","release-3.2.2-RC4","release-3.2.2-RC3","release-3.2.2-RC2","release-3.2.2-RC1","release-3.2.2-RC0","release-2.10.1-RC0","rel/release-2.10.1","release-3.1.4-RC4","rel/release-3.1.4","release-3.1.4-RC3","release-3.1.4-RC2","release-3.3.0-RC0","rel/release-3.3.0","release-3.1.4-RC1","release-3.1.4-RC0","remove-ozone","release-2.10.0-RC1","rel/release-2.10.0","release-2.10.0-RC0","ozone-0.4.1-alpha-RC0","ozone-0.4.1-alpha","release-3.2.1-RC0","rel/release-3.2.1","release-3.1.3-RC0","rel/release-3.1.3","release-2.9.0-RC3","rel/release-2.9.0","release-3.2.0-RC1","rel/release-3.2.0","release-3.1.0-RC1","rel/release-3.1.0","release-3.0.0-RC1","rel/release-3.0.0","rel/release-","release-3.1.2-RC1","rel/release-3.1.2","submarine-0.2.0-RC0","rel/submarine-0.2.0","ozone-0.4.0-alpha-RC2","ozone-0.4.0-alpha-RC1","ozone-0.4.0-alpha-RC0","release-3.1.2-RC0","release-3.2.0-RC0","release-3.1.1-RC0","rel/release-3.1.1","ozone-0.3.0-alpha-RC1","ozone-0.3.0-alpha","ozone-0.3.0-alpha-RC0","release-2.9.2-RC0","rel/release-2.9.2","ozone-0.2.1-alpha-RC0","release-2.8.5-RC0","rel/release-2.8.5","rel/release-2.7.7","release-2.7.7-RC0","release-3.0.3-RC0","rel/release-X.Y.Z","rel/release-3.0.3","release-2.8.4-RC0","rel/release-2.8.4","release-3.0.2-RC1","release-3.0.2-RC0","rel/release-3.0.2","rel/release-2.7.6","release-2.7.6-RC0","release-2.9.1-RC0","rel/release-2.9.1","release-3.1.0-RC0","release-3.0.1-RC1","rel/release-3.0.1","YARN-7055-2018-03-02","release-3.0.1-RC0","rel/release-2.7.5","release-2.7.5-RC1","release-2.7.5-RC0","release-2.8.3-RC0","rel/release-2.8.3","release-3.0.0-RC0","release-2.9.0-RC2","release-2.9.0-RC1","release-2.9.0-RC0","release-2.8.2-RC1","rel/release-2.8.2","YARN-5355_branch2-2017-10-17","YARN-5355_branch2-2017-10-14","release-3.0.0-beta1-RC0","rel/release-3.0.0-beta1","release-2.8.2-RC0","YARN-5355_branch2-2017-08-31","YARN-5355-2017-08-31","release-2.7.4-RC0","rel/release-2.7.4","release-3.0.0-alpha4-RC0","rel/release-3.0.0-alpha4","rel/release-2.8.1","release-2.8.0-RC3","rel/release-2.8.0","rel/release-3.0.0-alpha3","release-3.0.0-alpha2-RC0","rel/release-3.0.0-alpha2","YARN-5355-branch-2-2017-04-25","YARN-5355-2017-04-25","release-2.8.0-RC2","release-2.8.0-RC1","release-2.8.0-RC0","YARN-5355-branch-2-2016-11-06","YARN-5355-2016-11-06","release-2.6.5-RC1","rel/release-2.6.5","release-2.6.5-RC0","release-3.0.0-alpha1-RC0","rel/release-3.0.0-alpha1","release-2.7.3-RC2","rel/release-2.7.3","release-2.7.3-RC1","release-2.7.3-RC0","YARN-2928-2016-07-10","YARN-2928-2016-07-08","YARN-2928-2016-06-21","rel/release-2.6.4","release-2.6.4-RC0","rel/release-2.7.2","feature_YARN-2928-2016-01-20","release-2.7.2-RC2","release-2.7.2-RC1","release-2.6.3","release-2.6.3-RC1","release-2.6.3-RC0.1","release-2.6.3-RC0","release-2.7.2-RC0","feature_YARN-2928-2015-11-09","release-2.6.2","release-2.6.2-RC0","release-2.6.1","release-2.6.1-RC1","HADOOP-12111-moved-to-yetus","release-2.6.1-RC0","feature_YARN-2928_2015-08-24","release-2.7.1","release-2.7.1-RC0","release-2.7.0","release-2.7.0-RC0","release-2.5.2-RC1","release-2.5.2","release-2.6.0-rc1","release-2.6.0","cdh5-base-2.6.0","release-2.5.2-RC0","release-2.6.0-rc0","release-2.5.1","release-2.5.0","release-2.5.0-rc2","release-2.5.0-rc1","release-2.5.0-rc0","release-2.4.1","release-2.4.1-rc1","release-0.23.11","release-0.23.11-rc0","release-2.4.1-rc0","release-2.4.0","release-2.4.0-rc0","release-2.3.0","release-2.3.0-rc0","release-0.23.10","release-0.23.10-rc0","release-2.2.1-rc0","release-2.1.1-rc0","release-2.2.0","release-2.2.0-rc0","release-2.1.1-beta-rc0","release-2.1.0-beta","release-2.1.0-beta-rc2","release-2.0.6-alpha","release-2.0.6-alpha-rc1","release-2.0.6-alpha-rc0","branch-2.0.6-alpha-rc0","release-2.1.0-beta-rc1","release-0.23.9","release-0.23.9-rc0","release-2.1.0-beta-rc0","release-2.0.5-alpha","release-2.0.5-alpha-rc2","release-0.23.8","release-0.23.8-rc0","2.0.5-alpha-rc2","release-2.0.5-alpha-rc1","release-2.0.5-alpha-rc0","release-2.0.4.1-alpha-rc0","release-2.0.4-alpha","release-2.0.4-alpha-rc2","release-0.23.7","release-0.23.7-rc0","release-2.0.4-alpha-rc1","release-2.0.4-alpha-rc0","release-2.0.3-alpha","release-2.0.3-alpha-rc0","release-0.23.6","release-0.23.6-rc1","release-0.23.6-rc1-old","release-0.23.6-rc0","release-0.23.5","release-0.23.5-rc0","release-0.23.4","release-0.23.4-rc2","release-2.0.2-alpha","release-2.0.2-alpha-rc2","release-0.23.4-rc1","release-2.0.2-alpha-rc1","release-0.23.4-rc0","release-2.0.2-alpha-rc0","release-0.23.3","release-0.23.3-rc0","release-2.0.1-alpha","release-2.0.0-alpha","release-2.0.0-alpha-rc1","release-2.0.0-alpha-rc0","release-0.23.2-rc0","release-0.23.1","release-0.23.1-rc2","release-0.23.1-rc1","release-0.23.1-rc0","release-0.23.0","release-0.23.0-rc2","release-0.23.0-rc1","release-0.23.0-rc0","release-0.21.0","release-0.21.0-rc2","release-0.21.0-rc1","release-0.21.0-rc0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-25168.json"}}],"schema_version":"1.9.0"}