Fixed Common Vulnerabilities and Exposures in Cloudera Manager 7.13.1 and its cumulative hotfixes
Common Vulnerabilities and Exposures (CVE) that are fixed in Cloudera Manager 7.13.1 and its cumulative hotfixes.
Cloudera Manager 7.13.1 CHF14 (7.13.1.1400)
| CVEs | Package Name |
|---|---|
| CVE-2025-68121 | stdlib |
| CVE-2026-56857 | stdlib |
| CVE-2026-78663 | golang.org/x/net; stdlib |
| CVE-2025-22871 | stdlib |
| CVE-2026-84939 | org.freemarker:freemarker |
| CVE-2026-33186 | google.golang.org/grpc |
| CVE-2026-33997 | github.com/docker/docker |
| CVE-2026-78659 | golang.org/x/net; stdlib |
| CVE-2026-33814 | golang.org/x/net; stdlib |
| CVE-2026-78662 | golang.org/x/crypto |
| CVE-2026-97031 | stdlib |
| CVE-2026-39836 | stdlib |
| CVE-2026-56851 | golang.org/x/text |
| CVE-2026-78669 | golang.org/x/net; stdlib |
| CVE-2026-78660 | golang.org/x/net; stdlib |
| CVE-2026-94440 | stdlib |
| CVE-2026-32281 | stdlib |
| CVE-2026-32283 | stdlib |
| CVE-2026-56855 | golang.org/x/crypto |
| CVE-2026-39820 | stdlib |
| CVE-2026-78667 | stdlib |
| CVE-2026-33811 | stdlib |
| CVE-2026-56854 | golang.org/x/crypto |
| CVE-2026-56866 | stdlib |
| CVE-2026-97032 | golang.org/x/net; stdlib |
| CVE-2026-94439 | stdlib |
| CVE-2026-42306 | github.com/docker/docker |
| CVE-2026-39883 | go.opentelemetry.io/otel/sdk |
| CVE-2025-68156 | github.com/expr-lang/expr |
| CVE-2026-25681 | golang.org/x/net |
| CVE-2026-32280 | stdlib |
| GHSA-hrxh-6v49-42gf | google.golang.org/grpc |
| CVE-2024-45338 | golang.org/x/net |
| CVE-2024-34156 | stdlib |
| CVE-2026-32287 | github.com/antchfx/xpath |
| CVE-2026-56852 | golang.org/x/text |
| CVE-2026-27145 | stdlib |
| CVE-2026-46597 | golang.org/x/crypto |
| CVE-2026-56862 | stdlib |
| CVE-2026-39832 | golang.org/x/crypto |
| CVE-2026-39829 | golang.org/x/crypto |
| CVE-2026-42504 | stdlib |
| CVE-2026-56860 | stdlib |
| CVE-2026-39835 | golang.org/x/crypto |
| CVE-2026-46600 | golang.org/x/net |
| CVE-2026-56859 | stdlib |
| CVE-2026-56853 | stdlib |
| CVE-2025-47913 | golang.org/x/crypto |
| CVE-2026-42499 | stdlib |
| CVE-2026-42508 | golang.org/x/crypto |
| CVE-2026-39828 | golang.org/x/crypto |
| CVE-2024-45337 | golang.org/x/crypto |
| CVE-2025-61729 | stdlib |
| CVE-2026-24051 | go.opentelemetry.io/otel/sdk |
| CVE-2026-42151 | github.com/prometheus/prometheus |
| CVE-2026-39821 | golang.org/x/net; stdlib |
| CVE-2025-22869 | golang.org/x/crypto |
| CVE-2026-56858 | stdlib |
| CVE-2026-25679 | stdlib |
| CVE-2025-61726 | stdlib |
| CVE-2026-29181 | go.opentelemetry.io/otel |
| CVE-2026-39830 | golang.org/x/crypto |
| CVE-2026-27136 | golang.org/x/net |
| CVE-2026-46595 | golang.org/x/crypto |
| CVE-2026-39831 | golang.org/x/crypto |
| CVE-2026-41567 | github.com/docker/docker |
| CVE-2026-39822 | stdlib |
| CVE-2026-33818 | stdlib |
| CVE-2026-42154 | github.com/prometheus/prometheus |
| CVE-2025-4673 | stdlib |
| CVE-2026-2303 | go.mongodb.org/mongo-driver |
| CVE-2025-22872 | golang.org/x/net |
| CVE-2026-32282 | stdlib |
| CVE-2026-94448 | stdlib |
| CVE-2026-44903 | github.com/prometheus/prometheus |
| CVE-2026-40179 | github.com/prometheus/prometheus |
| CVE-2026-97030 | stdlib |
| CVE-2026-32289 | stdlib |
| CVE-2026-32288 | stdlib |
| CVE-2025-47911 | golang.org/x/net |
| CVE-2025-58190 | golang.org/x/net |
| CVE-2025-54388 | github.com/docker/docker |
| CVE-2025-61730 | stdlib |
| CVE-2025-22873 | stdlib |
| CVE-2026-39834 | golang.org/x/crypto |
| CVE-2026-39825 | stdlib |
| CVE-2025-22870 | golang.org/x/net; stdlib |
| CVE-2025-58189 | stdlib |
| CVE-2025-47914 | golang.org/x/crypto |
| GHSA-xmrv-pmrh-hhx2 | github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream; github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs; github.com/aws/aws-sdk-go-v2/service/s3 |
| CVE-2026-25680 | golang.org/x/net |
| CVE-2025-0913 | stdlib |
| CVE-2026-46598 | golang.org/x/crypto |
| CVE-2025-71405 | github.com/go-chi/chi/v5 |
| CVE-2026-39827 | golang.org/x/crypto |
| GHSA-w67g-5rqw-f597 | github.com/gorilla/websocket |
| CVE-2025-58181 | golang.org/x/crypto |
| CVE-2026-41568 | github.com/docker/docker |
| CVE-2025-58183 | stdlib |
| CVE-2025-61725 | stdlib |
| CVE-2026-42506 | golang.org/x/net |
| CVE-2025-61723 | stdlib |
| CVE-2025-61727 | stdlib |
| CVE-2026-39833 | golang.org/x/crypto |
| CVE-2025-58187 | stdlib |
| CVE-2025-61724 | stdlib |
| CVE-2024-34158 | stdlib |
| CVE-2026-27142 | stdlib |
| CVE-2024-34155 | stdlib |
| CVE-2024-45336 | stdlib |
| CVE-2026-39826 | stdlib |
| CVE-2026-42507 | golang.org/x/net |
| CVE-2026-42502 | stdlib |
| CVE-2026-39823 | stdlib |
| CVE-2025-47906 | stdlib |
| CVE-2025-47912 | stdlib |
| CVE-2025-61728 | stdlib |
| CVE-2025-58185 | go.opentelemetry.io/otel/sdk/log |
| CVE-2026-81872 | stdlib |
| CVE-2026-42505 | stdlib |
| CVE-2025-22866 | stdlib |
| CVE-2025-47907 | stdlib |
| CVE-2025-58188 | go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp; go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp; go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp |
| CVE-2026-39882 | stdlib |
| CVE-2026-27139 | stdlib |
| CVE-2025-58186 | stdlib |
| CVE-2024-45341 | go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc |
| CVE-2026-81871 | google.golang.org/grpc |
| CVE-2026-84304 | golang.org/x/sys |
| CVE-2026-39824 | google.golang.org/grpc |
| CVE-2026-84445 | go.opentelemetry.io/otel/sdk; go.opentelemetry.io/otel/exporters/otlp/otlptrace; go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc; go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp |
| CVE-2026-81870 | google.golang.org/grpc |
| CVE-2026-84303 | google.golang.org/grpc |
Cloudera Manager 7.13.1 CHF13 (7.13.1.1300)
| CVEs | Package Name |
|---|---|
| CVE-2026-0603 | org.hibernate:hibernate-core |
| CVE-2026-68494 | com.fasterxml.jackson.core:jackson-core |
| CVE-2025-71405 | github.com/go-chi/chi/v5 |
| CVE-2026-71497 | org.jsoup:jsoup |
| CVE-2026-66010 | DOMPurify |
Cloudera Manager 7.13.1 CHF12 (7.13.1.1200)
| CVEs | Package Name |
|---|---|
| CVE-2024-13009 | org.eclipse.jetty:jetty-server |
| CVE-2026-55153 | com.mchange:mchange-commons-java |
| CVE-2024-8184 | org.eclipse.jetty:jetty-nosql |
| CVE-2026-59949 | lz4-java |
| CVE-2025-66566 | lz4-java |
Cloudera Manager 7.13.1 CHF11 (7.13.1.1100)
| CVEs | Package Name |
|---|---|
| CVE-2026-34040 | Moby |
| CVE-2026-49844 | log4j |
| CVE-2026-69248 | cryptography |
| CVE-2026-18401 | jackson-core |
Cloudera Manager 7.13.1 CHF10 (7.13.1.1000)
| CVEs | Package Name |
|---|---|
| CVE-2026-34479 | log4j-api |
| CVE-2026-34477 | log4j |
| CVE-2026-34478 | log4j |
| CVE-2026-34480 | log4j |
| CVE-2026-49875 | Apache CXF |
| CVE-2026-50623 | Apache CXF |
| CVE-2026-50633 | Apache CXF |
| CVE-2026-50634 | Apache CXF |
Cloudera Manager 7.13.1 CHF9 (7.13.1.900)
This release does not fix any CVEs.
Cloudera Manager 7.13.1 CHF8 (7.13.1.800)
| CVEs | Package Name |
|---|---|
| CVE-2017-17485 | Jackson Databind |
| CVE-2017-7525 | Jackson Databind |
| CVE-2018-7489 | Jackson Databind |
| CVE-2020-10650 | Jackson Databind |
| CVE-2021-20190 | Jackson Databind |
| CVE-2020-36518 | Jackson Databind |
| CVE-2022-42003 | Jackson Databind |
| CVE-2022-42004 | Jackson Databind |
| CVE-2023-35116 | Jackson Databind |
| CVE-2025-68161 | Log4j-core |
| CVE-2026-27727 | mchange-commons-java |
Cloudera Manager 7.13.1 CHF7 (7.13.1.710)
| CVEs | Package Name |
|---|---|
| CVE-2025-68161 | Log4j |
Cloudera Manager 7.13.1 CHF6 (7.13.1.600)
| CVEs | Package Name |
|---|---|
| CVE-2012-6708 | Jquery |
| CVE-2015-9251 | Jquery |
| CVE-2019-11358 | Jquery |
| CVE-2020-11022 | Jquery |
| CVE-2020-11023 | Jquery |
| CVE-2020-7656 | Jquery |
| CVE-2011-4969 | Jquery |
| CVE-2025-48976 | Commons-fileupload |
| CVE-2025-48795 | Apache CXF |
| CVE-2025-5878 | Esapi |
| CVE-2025-35036 | Hibernate-validator |
| CVE-2019-10219 | Hibernate-validator |
| CVE-2023-1932 | Hibernate-validator |
| CVE-2020-10693 | Hibernate-validator |
| CVE-2022-3510 | Protobuf-java |
Cloudera Manager 7.13.1 CHF5 (7.13.1.500)
| CVEs | Package Name |
|---|---|
| CVE-2024-36114 | Aircompressor |
| CVE-2019-10172 | Jackson-mapper-asl |
| CVE-2024-22201 | Jetty |
| CVE-2024-47554 | Commons-io |
| CVE-2024-25710 | Commons-compress |
| CVE-2024-26308 | Commons-compress |
| CVE-2025-31672 | Apache POI |
| CVE-2024-38820 | Spring Framework |
| CVE-2025-22228 | Spring Security |
Cloudera Manager 7.13.1 CHF4 (7.13.1.400)
| CVEs | Package Name |
|---|---|
| CVE-2025-27636 | Apache Camel |
Cloudera Manager 7.13.1 CHF3 (7.13.1.300)
| CVEs | Package Name |
|---|---|
| CVE-2023-34442 | Apache Camel |
| CVE-2023-24998 | Apache Commons FileUpload |
| CVE-2024-53990 | AsyncHttpClient |
Cloudera Manager 7.13.1 CHF2 (7.13.1.200)
| CVEs | Package Name |
|---|---|
| CVE-2025-23184 | Apache CXF |
| CVE-2023-48795 | sshj |
| CVE-2024-47072 | XStream |
| CVE-2022-21699 | IPython |
| CVE-2015-5607 | IPython |
| CVE-2014-3429 | IPython |
| CVE-2015-4707 | IPython |
| CVE-2024-3651 | Idna |
| CVE-2012-5783 | httpclient |
| CVE-2014-3577 | httpclient |
| CVE-2020-13956 | httpclient |
| CVE-2015-5262 | httpclient |
| CVE-2012-6153 | httpclient |
Cloudera Manager 7.13.1 CHF1 (7.13.1.100)
| CVEs | Package Name |
|---|---|
| CVE-2023-44487 | Netty |
| CVE-2024-21634 | Ion-Java |
| CVE-2017-7536 | Hibernate-Validator |
| CVE-2018-1000873 | Jackson-databind |
| CVE-2017-15095 | Jackson-databind |
| CVE-2017-17485 | Jackson-databind |
| CVE-2017-7525 | Jackson-databind |
| CVE-2018-11307 | Jackson-databind |
| CVE-2018-14718 | Jackson-databind |
| CVE-2018-14719 | Jackson-databind |
| CVE-2018-7489 | Jackson-databind |
| CVE-2019-14379 | Jackson-databind |
| CVE-2019-14540 | Jackson-databind |
| CVE-2019-14892 | Jackson-databind |
| CVE-2019-16335 | Jackson-databind |
| CVE-2019-16942 | Jackson-databind |
| CVE-2019-16943 | Jackson-databind |
| CVE-2019-17267 | Jackson-databind |
| CVE-2019-17531 | Jackson-databind |
| CVE-2019-20330 | Jackson-databind |
| CVE-2020-8840 | Jackson-databind |
| CVE-2020-9547 | Jackson-databind |
| CVE-2020-9548 | Jackson-databind |
| CVE-2020-10673 | Jackson-databind |
| CVE-2018-5968 | Jackson-databind |
| CVE-2020-10650 | Jackson-databind |
| CVE-2020-24616 | Jackson-databind |
| CVE-2020-24750 | Jackson-databind |
| CVE-2020-35490 | Jackson-databind |
| CVE-2020-35491 | Jackson-databind |
| CVE-2020-36179 | Jackson-databind |
| CVE-2020-36180 | Jackson-databind |
| CVE-2020-36181 | Jackson-databind |
| CVE-2020-36182 | Jackson-databind |
| CVE-2020-36183 | Jackson-databind |
| CVE-2020-36184 | Jackson-databind |
| CVE-2020-36185 | Jackson-databind |
| CVE-2020-36186 | Jackson-databind |
| CVE-2020-36187 | Jackson-databind |
| CVE-2020-36188 | Jackson-databind |
| CVE-2020-36189 | Jackson-databind |
| CVE-2021-20190 | Jackson-databind |
| CVE-2018-12022 | Jackson-databind |
| CVE-2019-12086 | Jackson-databind |
| CVE-2019-14439 | Jackson-databind |
| CVE-2020-36518 | Jackson-databind |
| CVE-2022-42003 | Jackson-databind |
| CVE-2022-42004 | Jackson-databind |
| CVE-2019-12384 | Jackson-databind |
| CVE-2019-12814 | Jackson-databind |
| CVE-2020-13949 | Libthrift |
| CVE-2018-1320 | Libthrift |
| CVE-2019-0205 | Libthrift |
| CVE-2019-0210 | Libthrift |
| CVE-2018-11798 | Libthrift |
| CVE-2024-38808 | Spring Framework |
| CVE-2024-38829 | Spring ldap |
| CVE-2024-38821 | Spring Security |
| CVE-2024-38809 | Spring Framework |
| CVE-2024-38816 | Spring Framework |
| CVE-2024-38819 | Spring Framework |
| CVE-2024-38820 | Spring Framework |
