diff --git a/hadoop-mapreduce-project/CHANGES.txt b/hadoop-mapreduce-project/CHANGES.txt
index 519871a224..e68a62cc4e 100644
--- a/hadoop-mapreduce-project/CHANGES.txt
+++ b/hadoop-mapreduce-project/CHANGES.txt
@@ -305,6 +305,9 @@ Release 0.23.1 - Unreleased
     MAPREDUCE-3484. Fixed JobEndNotifier to not get interrupted before completing
     all its retries. (Ravi Prakash via vinodkv)
 
+    MAPREDUCE-3531. Fixed a race in ContainerTokenSecretManager. (Robert Joseph
+    Evans via sseth)
+
 Release 0.23.0 - 2011-11-01 
 
   INCOMPATIBLE CHANGES
diff --git a/hadoop-mapreduce-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-common/src/main/java/org/apache/hadoop/yarn/server/security/ContainerTokenSecretManager.java b/hadoop-mapreduce-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-common/src/main/java/org/apache/hadoop/yarn/server/security/ContainerTokenSecretManager.java
index 31c1e29900..7bf1678fab 100644
--- a/hadoop-mapreduce-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-common/src/main/java/org/apache/hadoop/yarn/server/security/ContainerTokenSecretManager.java
+++ b/hadoop-mapreduce-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-common/src/main/java/org/apache/hadoop/yarn/server/security/ContainerTokenSecretManager.java
@@ -18,8 +18,8 @@
 
 package org.apache.hadoop.yarn.server.security;
 
-import java.util.HashMap;
 import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
 
 import javax.crypto.SecretKey;
 
@@ -34,9 +34,9 @@ public class ContainerTokenSecretManager extends
   private static Log LOG = LogFactory
       .getLog(ContainerTokenSecretManager.class);
 
-  private Map<String, SecretKey> secretkeys =
-      new HashMap<String, SecretKey>();
-
+  Map<String, SecretKey> secretkeys =
+    new ConcurrentHashMap<String, SecretKey>();
+  
   // Used by master for generation of secretyKey per host
   public SecretKey createAndGetSecretKey(CharSequence hostName) {
     String hostNameStr = hostName.toString();