CVE-2022-25168

Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It has been used in Hadoop 2.x for yarn localization, which does enable remote code execution. It is used in Apache Spark, from the SQL command ADD ARCHIVE. As the ADD ARCHIVE command adds new binaries to the classpath, being able to execute shell scripts does not confer new permissions to the caller. SPARK-38305. "Check existence of file before untarring/zipping", which is included in 3.3.0, 3.1.4, 3.2.2, prevents shell commands being executed, regardless of which version of the hadoop libraries are in use. Users should upgrade to Apache Hadoop 2.10.2, 3.2.4, 3.3.3 or upper (including HADOOP-18136).

• CWE-78
• CWE-78

• https://lists.apache.org/thread/mxqnb39jfrwgs3j6phwvlrfq4mlox130Mailing List, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20220915-0007/Third Party Advisory
• https://lists.apache.org/thread/mxqnb39jfrwgs3j6phwvlrfq4mlox130Mailing List, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20220915-0007/Third Party Advisory

Published

Aug 4, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-25162Improper Input Validation vulnerability in Mitsubishi Electr…5.3
• CVE-2022-25163Improper Input Validation vulnerability in Mitsubishi Electr…9.8
• CVE-2022-25164Cleartext Storage of Sensitive Information vulnerability in …7.5
• CVE-2022-25165An issue was discovered in Amazon AWS VPN Client 2.0.0. A TO…7
• CVE-2022-25166An issue was discovered in Amazon AWS VPN Client 2.0.0. It i…5
• CVE-2022-25167Apache Flume versions 1.4.0 through 1.9.0 are vulnerable to …9.8
• CVE-2022-25169The BPG parser in versions of Apache Tika before 1.28.2 and …5.5
• CVE-2022-2517The Beaver Builder – WordPress Page Builder for WordPress is…5.4
• CVE-2022-25170The affected product is vulnerable to a stack-based buffer o…7.8
• CVE-2022-25171The package p4 before 0.0.7 are vulnerable to Command Inject…9.8
• CVE-2022-25172An information disclosure vulnerability exists in the web in…6.1
• CVE-2022-25173Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earli…8.8