Fixed Common Vulnerabilities and Exposures in Cloudera Manager 7.13.2
Common Vulnerabilities and Exposures (CVE) that are fixed in Cloudera Manager 7.13.2.
Cloudera Manager 7.13.2 SP1 (7.13.2.10000)
| CVEs | Package Name |
|---|---|
| CVE-2026-2332 | jetty-http |
| CVE-2025-68121 | stdlib |
| CVE-2026-27459 | pyOpenSSL |
| CVE-2026-33186 | google.golang.org/grpc |
| CVE-2025-47273 | setuptools |
| CVE-2026-33997 | github.com/docker/docker |
| CVE-2026-34040 | github.com/docker/docker |
| CVE-2025-68156 | github.com/expr-lang/expr |
| CVE-2025-58188 | stdlib |
| CVE-2025-61723 | stdlib |
| CVE-2025-66418 | urllib3 |
| CVE-2025-66471 | urllib3 |
| CVE-2025-61726 | stdlib |
| CVE-2026-5588 | org.bouncycastle:bcpkix-jdk18on |
| CVE-2026-5598 | org.bouncycastle:bcprov-jdk18on |
| CVE-2026-73507 | io.netty:netty-codec-xml |
| CVE-2026-21441 | urllib3 |
| CVE-2025-14813 | org.bouncycastle:bcprov-jdk18on |
| CVE-2026-32287 | github.com/antchfx/xpath |
| CVE-2025-47913 | golang.org/x/crypto |
| CVE-2026-3505 | org.bouncycastle:bcpg-jdk18on |
| CVE-2025-61729 | stdlib |
| CVE-2025-61725 | stdlib |
| CVE-2025-58187 | stdlib |
| CVE-2026-45300 | org.asynchttpclient:async-http-client |
| CVE-2026-42306 | github.com/docker/docker |
| CVE-2026-41567 | github.com/docker/docker |
| CVE-2026-24051 | go.opentelemetry.io/otel/sdk |
| CVE-2026-39883 | go.opentelemetry.io/otel/sdk |
| CVE-2026-41238 | DOMPurify |
| CVE-2026-40490 | org.asynchttpclient:async-http-client |
| CVE-2026-41239 | DOMPurify |
| CVE-2026-0636 | org.bouncycastle:bcprov-jdk18on |
| CVE-2025-61728 | stdlib |
| CVE-2026-2303 | go.mongodb.org/mongo-driver |
| CVE-2026-26007 | cryptography |
| CVE-2025-61727 | stdlib |
| CVE-2024-12797 | cryptography |
| CVE-2026-65912 | DOMPurify |
| CVE-2026-41240 | DOMPurify |
| CVE-2025-15599 | DOMPurify |
| CVE-2026-65903 | DOMPurify |
| CVE-2026-65914 | DOMPurify |
| CVE-2025-50182 | urllib3 |
| CVE-2026-65913 | DOMPurify |
| CVE-2025-50181 | urllib3 |
| CVE-2026-0540 | DOMPurify |
| CVE-2025-26791 | DOMPurify |
| CVE-2026-41568 | github.com/docker/docker |
| CVE-2025-53864 | com.nimbusds:nimbus-jose-jwt |
| CVE-2026-27448 | pyOpenSSL |
| CVE-2025-47914 | golang.org/x/crypto |
| CVE-2025-58186 | stdlib |
| CVE-2025-58181 | golang.org/x/crypto |
| CVE-2025-61724 | stdlib |
| CVE-2026-44431 | urllib3 |
| CVE-2025-61730 | stdlib |
| CVE-2025-58185 | stdlib |
| CVE-2025-47912 | stdlib |
| CVE-2025-47911 | golang.org/x/net |
| CVE-2026-34073 | cryptography |
| CVE-2025-58190 | golang.org/x/net |
| CVE-2025-58189 | stdlib |
| CVE-2026-73508 | io.netty:netty-codec-dns |
| CVE-2026-39882 |
|
| CVE-2025-54388 | github.com/docker/docker |
| CVE-2025-58183 | stdlib |
| CVE-2025-8869 | pip |
Cloudera Manager 7.13.2 CHF1 (7.13.2.100)
| CVEs | Package Name |
|---|---|
| CVE-2026-40453 | Apache Camel |
| CCVE-2026-40860 | Apache Camel |
| CVE-2026-33454 | Apache Camel |
| CVE-2026-25747 | Apache Camel |
| CVE-2026-27172 | Apache Camel |
| CVE-2026-40473 | Apache Camel |
| CVE-2026-34479 | Log4j |
| CVE-2026-34477 | Log4j |
| CVE-2026-34478 | Log4j |
| CVE-2026-34480 | Log4j |
| CVE-2026-27727 | mchange-commons-java |
| CVE-2026-42198 | postgresql |
Cloudera Manager 7.13.2.0
| CVEs | Package Name |
|---|---|
| CVE-2025-46762 | Apache Parquet |
| CVE-2024-29131 | Apache Commons |
| CVE-2022-3509 | protobuf-java |
| CVE-2020-13936 | Apache Velocity Engine |
| CVE-2022-3171 | protobuf-java |
| CVE-2024-53990 | async-http-client |
| CVE-2018-10237 | Guava |
| CVE-2024-47561 | Apache Avro |
| CVE-2023-39410 | Apache Avro |
| CVE-2012-6708 | jquery |
| CVE-2015-9251 | jquery |
| CVE-2019-11358 | jquery |
| CVE-2020-11022 | jquery |
| CVE-2020-11023 | jquery |
| CVE-2020-7656 | jquery |
| CVE-2011-4969 | jquery |
| CVE-2023-44487 | Netty |
| CVE-2024-21634 | ion-java |
| CVE-2025-8916 | Bouncycastle |
| CVE-2024-23114 | Apache Camel |
| CVE-2024-22369 | Apache Camel |
| CVE-2024-22371 | Apache Camel |
| CVE-2025-27636 | Apache Camel |
| CVE-2025-29891 | Apache Camel |
| CVE-2023-34442 | Apache Camel |
| CVE-2024-25710 | Commons-compress |
| CVE-2024-26308 | Commons-compress |
| CVE-2025-48976 | Commons-fileupload |
| CVE-2012-5783 | Commons-httpclient |
| CVE-2020-13956 | Commons-httpclient |
| CVE-2024-47554 | Commons-io |
| CVE-2025-23184 | Apache CXF |
| CVE-2020-36843 | Eddsa |
| CVE-2025-5878 | Esapi |
| CVE-2024-13009 | Eclipse Jetty |
| CVE-2024-8184 | Eclipse Jetty |
| CVE-2017-7536 | Hibernate-validator |
| CVE-2025-35036 | Hibernate-validator |
| CVE-2019-10219 | Hibernate-validator |
| CVE-2023-1932 | Hibernate-validator |
| CVE-2020-10693 | Hibernate-validator |
| CVE-2024-36114 | Aircompressor |
| CVE-2018-1000873 | Jackson Databind |
| CVE-2017-15095 | Jackson Databind |
| CVE-2017-17485 | Jackson Databind |
| CVE-2017-7525 | Jackson Databind |
| CVE-2018-11307 | Jackson Databind |
| CVE-2018-14718 | Jackson Databind |
| CVE-2018-14719 | Jackson Databind |
| CVE-2018-7489 | Jackson Databind |
| CVE-2019-14379 | Jackson Databind |
| CVE-2019-14540 | Jackson Databind |
| CVE-2019-14892 | Jackson Databind |
| CVE-2019-16335 | Jackson Databind |
| CVE-2019-16942 | Jackson Databind |
| CVE-2019-16943 | Jackson Databind |
| CVE-2019-17267 | Jackson Databind |
| CVE-2019-17531 | Jackson Databind |
| CVE-2019-20330 | Jackson Databind |
| CVE-2020-8840 | Jackson Databind |
| CVE-2020-9547 | Jackson Databind |
| CVE-2020-9548 | Jackson Databind |
| CVE-2020-10673 | Jackson Databind |
| CVE-2018-5968 | Jackson Databind |
| CVE-2020-10650 | Jackson Databind |
| CVE-2020-24616 | Jackson Databind |
| CVE-2020-24750 | Jackson Databind |
| CVE-2020-35490 | Jackson Databind |
| CVE-2020-35491 | Jackson Databind |
| CVE-2020-36179 | Jackson Databind |
| CVE-2020-36180 | Jackson Databind |
| CVE-2020-36181 | Jackson Databind |
| CVE-2020-36182 | Jackson Databind |
| CVE-2020-36183 | Jackson Databind |
| CVE-2020-36184 | Jackson Databind |
| CVE-2020-36185 | Jackson Databind |
| CVE-2020-36186 | Jackson Databind |
| CVE-2020-36187 | Jackson Databind |
| CVE-2020-36188 | Jackson Databind |
| CVE-2020-36189 | Jackson Databind |
| CVE-2021-20190 | Jackson Databind |
| CVE-2018-12022 | Jackson Databind |
| CVE-2019-12086 | Jackson Databind |
| CVE-2019-14439 | Jackson Databind |
| CVE-2020-36518 | Jackson Databind |
| CVE-2022-42003 | Jackson Databind |
| CVE-2022-42004 | Jackson Databind |
| CVE-2019-12384 | Jackson Databind |
| CVE-2019-12814 | Jackson Databind |
| CVE-2019-10172 | Jackson-mapper-asl |
| CVE-2024-22201 | Eclipse Jetty |
| CVE-2024-9823 | Eclipse Jetty |
| CVE-2025-59340 | jinjava |
| CVE-2026-25526 | jinjava |
| CVE-2020-13949 | Apache Thrift |
| CVE-2018-1320 | Apache Thrift |
| CVE-2019-0205 | Apache Thrift |
| CVE-2019-0210 | Apache Thrift |
| CVE-2018-11798 | Apache Thrift |
| CVE-2025-68161 | log4j-core |
| CVE-2025-12183 | lz4-java |
| CVE-2025-66566 | lz4-java |
| CVE-2025-31672 | Apache Poi |
| CVE-2022-3510 | protobuf-java |
| CVE-2010-5312 | jquery-ui |
| CVE-2016-7103 | jquery-ui |
| CVE-2021-41182 | jquery-ui |
| CVE-2021-41183 | jquery-ui |
| CVE-2021-41184 | jquery-ui |
| CVE-2022-31160 | jquery-ui |
| CVE-2024-38820 | Spring Framework |
| CVE-2024-38808 | Spring Framework |
| CVE-2025-41249 | Spring Framework |
| CVE-2025-41242 | Spring Framework |
| CVE-2025-22228 | Spring Security |
| CVE-2024-38821 | Spring Security |
| CVE-2024-38809 | Spring Framework |
| CVE-2024-38828 | Spring Framework |
| CVE-2024-38816 | Spring Framework |
| CVE-2023-48795 | sshj |
| CVE-2020-26870 | DOMPurify |
| CVE-2021-40690 | xmlsec |
| CVE-2023-44483 | xmlsec |
| CVE-2015-1796 | xmltooling |
| CVE-2024-47072 | xstream |
