question Re: CVE-2025-3884 Cloudera Hue Directory Traversal Information Disclosure Vulnerability in Support Questions

CVE-2025-3884 Cloudera Hue Directory Traversal Information Disclosure Vulnerability

Shivakuk — Thu, 01 May 2025 11:06:49 GMT

@Cloudera We have received below mentioned vulnerability from our security team. Could you please check and let us know if our Hadoop cluster is impacted by this vulnerability.
If yes the can you please provide a fix for this.

CVE-2025-3884 Cloudera Hue Directory Traversal Information Disclosure Vulnerability

CM version : Cloudera Enterprise 6.3.4 (#21561749)
CDH Version : 6.3.4-1.cdh6.3.4.p5552.32087246

Re: CVE-2025-3884 Cloudera Hue Directory Traversal Information Disclosure Vulnerability

jzumbado — Fri, 02 May 2025 17:16:10 GMT

Our team is actively investigating the reported CVE. After internal discussions, we'd like to clarify that the custom Ace fork is a developer-only tool located in the tools folder. It is not included in production builds or used at runtime, so any issues in it do not impact Hue or pose a security risk. However, we will reconfirm on this and keep you updated.

Re: CVE-2025-3884 Cloudera Hue Directory Traversal Information Disclosure Vulnerability

Shivakuk — Sun, 04 May 2025 10:04:05 GMT

Hi,

Thanks for the details. Sure, please keep me updated on this. This seems critical to my security team.