Skip to main content

Use of a Broken or Risky Cryptographic Algorithm

CVE-2012-4449

High
9.8/10

Summary

Apache Hadoop before 0.23.4, 1.x before 1.0.4, and 2.x up to 2.0.2-alpha generate token passwords using a 20-bit secret when Kerberos security features are enabled, which makes it easier for context-dependent attackers to crack secret keys via a brute-force attack.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • HIGH

CWE-327 - Use of a Broken or Risky Cryptographic Algorithm

The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in the exposure of sensitive information.

References

Advisory Timeline

  • Published