CVE-2021-37404: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

June 13, 2022 (updated June 27, 2023)

There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may result in a denial of service or arbitrary code execution. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.

References

lists.apache.org/thread/2h56ztcj3ojc66qzf1nno88vjw9vd4wo
nvd.nist.gov/vuln/detail/CVE-2021-37404

Code Behaviors & Features

Detect and mitigate CVE-2021-37404 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →