{"id":"CVE-2024-23454","summary":"Apache Hadoop: Temporary File Local Information Disclosure","details":"Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content.\nThis is because, on unix-like systems, the system temporary directory is\nshared between all local users. As such, files written in this directory,\nwithout setting the correct posix permissions explicitly, may be viewable\nby all other local users.","aliases":["GHSA-f5fw-25gw-5m92"],"modified":"2026-08-12T04:01:19.686604653Z","published":"2024-09-25T07:45:43.496Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23454.json","unresolved_ranges":[{"extracted_events":[{"fixed":"3.4.0"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"apache","cwe_ids":["CWE-378"]},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2024/09/25/1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23454.json"},{"type":"ADVISORY","url":"https://lists.apache.org/thread/xlo7q8kn4tsjvx059r789oz19hzgfkfs"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23454"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20241101-0002/"},{"type":"REPORT","url":"https://issues.apache.org/jira/browse/HADOOP-19031"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/hadoop","events":[{"introduced":"0"},{"fixed":"bd8b77f398f626bb7791783192ee7a5dfaeec760"},{"fixed":"65a2bdeeead0c4826588f2bb05b10bb307a2727f"}],"database_specific":{"cpe":"cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"3.4.0"}],"source":"CPE_RANGE"}}],"versions":["release-3.5.0-RC2","rel/release-3.5.0","release-3.5.0-RC1","release-3.5.0-RC0","release-3.4.0-RC2","release-3.4.0-RC1","release-3.4.0-RC0","release-3.3.6-RC1","rel/release-3.3.6","release-3.3.6-RC0","release-3.3.5-RC3","rel/release-3.3.5","release-3.3.5-RC2","release-3.3.5-RC1","release-3.3.5-RC0","release-3.3.4-RC1","rel/release-3.3.4","release-3.3.4-RC0","release-3.3.3-RC1","release-3.3.3-RC0","rel/release-3.3.3","release-3.2.4-RC0","rel/release-3.2.4","release-2.10.2-RC0","rel/release-2.10.2","release-3.2.3-RC1","rel/release-3.2.3","release-3.2.3-RC0","release-3.3.2-RC5","release-3.3.2-RC4","rel/release-3.3.2","release-3.3.2-RC3","release-3.3.2-RC2","release-3.3.2-RC1","release-3.3.2-RC0","release-3.3.1-RC3","rel/release-3.3.1","release-3.3.1-RC2","release-3.3.1-RC1","release-3.3.1-RC0","release-3.2.2-RC5","rel/release-3.2.2","release-3.2.2-RC4","release-3.2.2-RC3","release-3.2.2-RC2","release-3.2.2-RC1","release-3.2.2-RC0","release-2.10.1-RC0","rel/release-2.10.1","release-3.1.4-RC4","rel/release-3.1.4","release-3.1.4-RC3","release-3.1.4-RC2","release-3.3.0-RC0","rel/release-3.3.0","release-3.1.4-RC1","release-3.1.4-RC0","remove-ozone","release-2.10.0-RC1","rel/release-2.10.0","release-2.10.0-RC0","ozone-0.4.1-alpha-RC0","ozone-0.4.1-alpha","release-3.2.1-RC0","rel/release-3.2.1","release-3.1.3-RC0","rel/release-3.1.3","release-2.9.0-RC3","rel/release-2.9.0","release-3.2.0-RC1","rel/release-3.2.0","release-3.1.0-RC1","rel/release-3.1.0","release-3.0.0-RC1","rel/release-3.0.0","rel/release-","release-3.1.2-RC1","rel/release-3.1.2","submarine-0.2.0-RC0","rel/submarine-0.2.0","ozone-0.4.0-alpha-RC2","ozone-0.4.0-alpha-RC1","ozone-0.4.0-alpha-RC0","release-3.1.2-RC0","release-3.2.0-RC0","release-3.1.1-RC0","rel/release-3.1.1","ozone-0.3.0-alpha-RC1","ozone-0.3.0-alpha","ozone-0.3.0-alpha-RC0","release-2.9.2-RC0","rel/release-2.9.2","ozone-0.2.1-alpha-RC0","release-2.8.5-RC0","rel/release-2.8.5","rel/release-2.7.7","release-2.7.7-RC0","release-3.0.3-RC0","rel/release-X.Y.Z","rel/release-3.0.3","release-2.8.4-RC0","rel/release-2.8.4","release-3.0.2-RC1","release-3.0.2-RC0","rel/release-3.0.2","rel/release-2.7.6","release-2.7.6-RC0","release-2.9.1-RC0","rel/release-2.9.1","release-3.1.0-RC0","release-3.0.1-RC1","rel/release-3.0.1","YARN-7055-2018-03-02","release-3.0.1-RC0","rel/release-2.7.5","release-2.7.5-RC1","release-2.7.5-RC0","release-2.8.3-RC0","rel/release-2.8.3","release-3.0.0-RC0","release-2.9.0-RC2","release-2.9.0-RC1","release-2.9.0-RC0","release-2.8.2-RC1","rel/release-2.8.2","YARN-5355_branch2-2017-10-17","YARN-5355_branch2-2017-10-14","release-3.0.0-beta1-RC0","rel/release-3.0.0-beta1","release-2.8.2-RC0","YARN-5355_branch2-2017-08-31","YARN-5355-2017-08-31","release-2.7.4-RC0","rel/release-2.7.4","release-3.0.0-alpha4-RC0","rel/release-3.0.0-alpha4","rel/release-2.8.1","release-2.8.0-RC3","rel/release-2.8.0","rel/release-3.0.0-alpha3","release-3.0.0-alpha2-RC0","rel/release-3.0.0-alpha2","YARN-5355-branch-2-2017-04-25","YARN-5355-2017-04-25","release-2.8.0-RC2","release-2.8.0-RC1","release-2.8.0-RC0","YARN-5355-branch-2-2016-11-06","YARN-5355-2016-11-06","release-2.6.5-RC1","rel/release-2.6.5","release-2.6.5-RC0","release-3.0.0-alpha1-RC0","rel/release-3.0.0-alpha1","release-2.7.3-RC2","rel/release-2.7.3","release-2.7.3-RC1","release-2.7.3-RC0","YARN-2928-2016-07-10","YARN-2928-2016-07-08","YARN-2928-2016-06-21","rel/release-2.6.4","release-2.6.4-RC0","rel/release-2.7.2","feature_YARN-2928-2016-01-20","release-2.7.2-RC2","release-2.7.2-RC1","release-2.6.3","release-2.6.3-RC1","release-2.6.3-RC0.1","release-2.6.3-RC0","release-2.7.2-RC0","feature_YARN-2928-2015-11-09","release-2.6.2","release-2.6.2-RC0","release-2.6.1","release-2.6.1-RC1","HADOOP-12111-moved-to-yetus","release-2.6.1-RC0","feature_YARN-2928_2015-08-24","release-2.7.1","release-2.7.1-RC0","release-2.7.0","release-2.7.0-RC0","release-2.5.2-RC1","release-2.5.2","release-2.6.0-rc1","release-2.6.0","cdh5-base-2.6.0","release-2.5.2-RC0","release-2.6.0-rc0","release-2.5.1","release-2.5.0","release-2.5.0-rc2","release-2.5.0-rc1","release-2.5.0-rc0","release-2.4.1","release-2.4.1-rc1","release-0.23.11","release-0.23.11-rc0","release-2.4.1-rc0","release-2.4.0","release-2.4.0-rc0","release-2.3.0","release-2.3.0-rc0","release-0.23.10","release-0.23.10-rc0","release-2.2.1-rc0","release-2.1.1-rc0","release-2.2.0","release-2.2.0-rc0","release-2.1.1-beta-rc0","release-2.1.0-beta","release-2.1.0-beta-rc2","release-2.0.6-alpha","release-2.0.6-alpha-rc1","release-2.0.6-alpha-rc0","branch-2.0.6-alpha-rc0","release-2.1.0-beta-rc1","release-0.23.9","release-0.23.9-rc0","release-2.1.0-beta-rc0","release-2.0.5-alpha","release-2.0.5-alpha-rc2","release-0.23.8","release-0.23.8-rc0","2.0.5-alpha-rc2","release-2.0.5-alpha-rc1","release-2.0.5-alpha-rc0","release-2.0.4.1-alpha-rc0","release-2.0.4-alpha","release-2.0.4-alpha-rc2","release-0.23.7","release-0.23.7-rc0","release-2.0.4-alpha-rc1","release-2.0.4-alpha-rc0","release-2.0.3-alpha","release-2.0.3-alpha-rc0","release-0.23.6","release-0.23.6-rc1","release-0.23.6-rc1-old","release-0.23.6-rc0","release-0.23.5","release-0.23.5-rc0","release-0.23.4","release-0.23.4-rc2","release-2.0.2-alpha","release-2.0.2-alpha-rc2","release-0.23.4-rc1","release-2.0.2-alpha-rc1","release-0.23.4-rc0","release-2.0.2-alpha-rc0","release-0.23.3","release-0.23.3-rc0","release-2.0.1-alpha","release-2.0.0-alpha","release-2.0.0-alpha-rc1","release-2.0.0-alpha-rc0","release-0.23.2-rc0","release-0.23.1","release-0.23.1-rc2","release-0.23.1-rc1","release-0.23.1-rc0","release-0.23.0","release-0.23.0-rc2","release-0.23.0-rc1","release-0.23.0-rc0","release-0.21.0","release-0.21.0-rc2","release-0.21.0-rc1","release-0.21.0-rc0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-23454.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}