High
Security advisory
In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be corrupted across storing in fsimage and reading back from fsimage.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2018-11768
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 08:00 UTC · Revision 1
Source evidence
In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be corrupted across storing in fsimage and reading back from fsimage.
osv:CVE-2018-11768
Complete source record
{
"id": "74405b05c1c366f813595278a83ed3dd4546c684b45c01f5ac1f07f8eba24a77",
"url": "https://osv.dev/vulnerability/CVE-2018-11768",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2018-11768",
"summary": "In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be corrupted across storing in fsimage and reading back from fsimage.",
"evidence": "osv:CVE-2018-11768",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2018-11768",
"aliases": [
"CVE-2018-11768",
"GHSA-hx83-rpqf-m267"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/apache/hadoop",
"type": "GIT",
"events": [
{
"introduced": "c40e9eb30aa4bf8f3c3eb7c139a06c665417b8c6"
},
{
"last_affected": "17e75c2a11685af3e043aa5e604dc831e5b14674"
},
{
"introduced": "756ebc8394e473ac25feac05fa493f6d612e6c50"
},
{
"last_affected": "e30710aea4e6e55e69372929106cf119af06fd0e"
},
{
"introduced": "496dc57cc2e4f4da117f7a8e3840aaeac0c1d2d0"
},
{
"last_affected": "37fd7d752db73d984dc31e0cdfd590d252f5e075"
},
{
"introduced": "16b70619a24cdcf5d3b0fcf4b58ca77238ccbe6d"
},
{
"last_affected": "2b9a8c1d3a2caf1e733d57f346af3ff0d5ba529c"
},
{
"introduced": "da30cf664ccc99a54059eb6b9ffa73dc68a95ed2"
},
{
"last_affected": "1002c582d86ae8689c497c3d31b73f1ab92d5e29"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.2.0"
},
{
"last_affected": "2.8.4"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.9.0"
},
{
"last_affected": "2.9.1"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.1"
},
{
"last_affected": "3.0.3"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.1.0"
},
{
"last_affected": "3.1.1"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:hadoop:2.0.0:alpha:*:*:*:*:*:*",
"range": [
{
"introduced": "2.0.0-alpha"
},
{
"last_affected": "2.0.0-alpha"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:hadoop:2.0.1:alpha:*:*:*:*:*:*",
"range": [
{
"introduced": "2.0.1-alpha"
},
{
"last_affected": "2.0.1-alpha"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:hadoop:2.0.2:alpha:*:*:*:*:*:*",
"range": [
{
"introduced": "2.0.2-alpha"
},
{
"last_affected": "2.0.2-alpha"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:hadoop:2.0.3:alpha:*:*:*:*:*:*",
"range": [
{
"introduced": "2.0.3-alpha"
},
{
"last_affected": "2.0.3-alpha"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:hadoop:2.0.4:alpha:*:*:*:*:*:*",
"range": [
{
"introduced": "2.0.4-alpha"
},
{
"last_affected": "2.0.4-alpha"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:hadoop:2.0.5:alpha:*:*:*:*:*:*",
"range": [
{
"introduced": "2.0.5-alpha"
},
{
"last_affected": "2.0.5-alpha"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:hadoop:2.0.6:alpha:*:*:*:*:*:*",
"range": [
{
"introduced": "2.0.6-alpha"
},
{
"last_affected": "2.0.6-alpha"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:hadoop:2.1.0:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "2.1.0-beta"
},
{
"last_affected": "2.1.0-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:hadoop:2.1.1:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "2.1.1-beta"
},
{
"last_affected": "2.1.1-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:hadoop:3.0.0:-:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.0-NA"
},
{
"last_affected": "3.0.0-NA"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:hadoop:3.0.0:alpha1:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.0-alpha1"
},
{
"last_affected": "3.0.0-alpha1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:hadoop:3.0.0:alpha2:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.0-alpha2"
},
{
"last_affected": "3.0.0-alpha2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:hadoop:3.0.0:alpha3:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.0-alpha3"
},
{
"last_affected": "3.0.0-alpha3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:hadoop:3.0.0:alpha4:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.0-alpha4"
},
{
"last_affected": "3.0.0-alpha4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:hadoop:3.0.0:beta1:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.0-beta1"
},
{
"last_affected": "3.0.0-beta1"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"2.0.0-alpha",
"2.0.1-alpha",
"2.0.2-alpha",
"2.0.3-alpha",
"2.0.4-alpha",
"2.0.5-alpha",
"2.0.6-alpha",
"2.1.0-beta",
"2.1.1-beta",
"3.0.0-NA",
"3.0.0-alpha1",
"3.0.0-alpha2",
"3.0.0-alpha3",
"3.0.0-alpha4",
"3.0.0-beta1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-11768.json"
}
}
],
"modified": "2026-10-24T10:31:01.563845834Z",
"provider": "osv",
"references": [
"https://lists.apache.org/thread.html/2067a797b330530a6932f4b08f703b3173253d0a2b7c8c524e54adaf%40%3Cgeneral.hadoop.apache.org%3E",
"https://lists.apache.org/thread.html/2c9cc65864be0058a5d5ed2025dfb9c700bf23d352b0c826c36ff96a%40%3Chdfs-dev.hadoop.apache.org%3E",
"https://lists.apache.org/thread.html/72ca514e01cd5f08151e74f9929799b4cbe1b6e9e6cd24faa72ffcc6%40%3Cdev.lucene.apache.org%3E",
"https://lists.apache.org/thread.html/9b609d4392d886711e694cf40d86f770022baf42a1b1aa97e8244c87%40%3Cdev.lucene.apache.org%3E",
"https://lists.apache.org/thread.html/caacbbba2dcc1105163f76f3dfee5fbd22e0417e0783212787086378%40%3Cgeneral.hadoop.apache.org%3E",
"https://lists.apache.org/thread.html/ceb16af9139ab0fea24aef935b6321581976887df7ad632e9a515dda%40%3Cdev.lucene.apache.org%3E",
"https://lists.apache.org/thread.html/ea6d2dfbefab8ebe46be18b05136b83ae53b7866f1bc60c680a2b600%40%3Chdfs-dev.hadoop.apache.org%3E",
"https://lists.apache.org/thread.html/f20bb4e055d8394fc525cc7772fb84096f706389043e76220c8a29a4%40%3Chdfs-dev.hadoop.apache.org%3E",
"https://lists.apache.org/thread.html/r02e39d7beb32eebcdbb4b516e95f67d71c90d5d462b26f4078d21eeb%40%3Cdev.flink.apache.org%3E",
"https://lists.apache.org/thread.html/r02e39d7beb32eebcdbb4b516e95f67d71c90d5d462b26f4078d21eeb%40%3Cuser.flink.apache.org%3E"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:apache:hadoop:2.0.0:-:*:*:*:*:*:*",
"cpe:2.3:a:apache:hadoop:2.0.1:-:*:*:*:*:*:*",
"cpe:2.3:a:apache:hadoop:2.0.2:-:*:*:*:*:*:*",
"cpe:2.3:a:apache:hadoop:2.0.3:-:*:*:*:*:*:*",
"cpe:2.3:a:apache:hadoop:2.0.4:-:*:*:*:*:*:*",
"cpe:2.3:a:apache:hadoop:2.0.5:-:*:*:*:*:*:*",
"cpe:2.3:a:apache:hadoop:2.0.6:-:*:*:*:*:*:*",
"cpe:2.3:a:apache:hadoop:2.1.0:-:*:*:*:*:*:*"
],
"vendor_product": "apache:hadoop",
"extracted_events": [
{
"range": [
{
"introduced": "2.0.0-NA"
},
{
"last_affected": "2.0.0-NA"
},
{
"introduced": "2.0.1-NA"
},
{
"last_affected": "2.0.1-NA"
},
{
"introduced": "2.0.2-NA"
},
{
"last_affected": "2.0.2-NA"
},
{
"introduced": "2.0.3-NA"
},
{
"last_affected": "2.0.3-NA"
},
{
"introduced": "2.0.4-NA"
},
{
"last_affected": "2.0.4-NA"
},
{
"introduced": "2.0.5-NA"
},
{
"last_affected": "2.0.5-NA"
},
{
"introduced": "2.0.6-NA"
},
{
"last_affected": "2.0.6-NA"
},
{
"introduced": "2.1.0-NA"
},
{
"last_affected": "2.1.0-NA"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2018-11768",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 439813,
"published_at": "2019-10-04T14:15:10.903+00:00"
}