Details
-
Bug
-
Status: Resolved
-
Blocker
-
Resolution: Fixed
-
2.8.0, 3.0.0-alpha1, 3.0.0-alpha2
-
CVE-2017-7669 / YARN's Docker support did not do enough input validation. This allowed a root level escalation from an ordinary user account.
-
Important
-
CVE-2017-7669
Description
YARN-3853 and friends do not do enough input validation. They allow a user to do escalate privileges at root trivially. See https://effectivemachines.com/2017/06/02/docker-security-in-framework-managed-multi-user-environments/ for more information.