Use of a Broken or Risky Cryptographic Algorithm
CVE-2012-4449
Summary
Apache Hadoop before 0.23.4, 1.x before 1.0.4, and 2.x up to 2.0.2-alpha generate token passwords using a 20-bit secret when Kerberos security features are enabled, which makes it easier for context-dependent attackers to crack secret keys via a brute-force attack.
- LOW
- NETWORK
- HIGH
- UNCHANGED
- NONE
- NONE
- HIGH
- HIGH
CWE-327 - Use of a Broken or Risky Cryptographic Algorithm
The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in the exposure of sensitive information.
Advisory Timeline
- Published