CVE-2018-1656: Path Traversal
IBM JDK 8 SR5 FP20 (8.0.5.20), 7 R1 SR4 FP30 (7.1.4.30), 7 SR10 FP30 (7.0.10.30), and 6 SR16 FP70 (6.0.16.70) fix a flaw described by upstream as:
The IBM Java Runtime Environment's Diagnostic Tooling Framework for Java (DTFJ) does not protect against path traversal attacks when extracting compressed dump files.
References:
https://www-01.ibm.com/support/docview.wss?uid=ibm10719653 https://developer.ibm.com/javasdk/support/security-vulnerabilities/#IBMSecurityUpdateAugust2018
Other sources
The IBM Java Runtime Environment's Diagnostic Tooling Framework for Java (DTFJ) (IBM SDK, Java Technology Edition 6.0 , 7.0, and 8.0) does not protect against path traversal attacks when extracting compressed dump files. IBM X-Force ID: 144882.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2018-1656.
What is the severity of CVE-2018-1656?
The severity of CVE-2018-1656 is high with a CVSS score of 6.5.
Which software versions are affected by CVE-2018-1656?
IBM SDK Java Technology Edition 6.0, 7.0, and 8.0, as well as Redhat Satellite 5.6, 5.7, 5.8, Redhat Enterprise Linux Desktop 6.0, 7.0, Redhat Enterprise Linux Server 6.0, 7.0, Redhat Enterprise Linux Workstation 6.0, 7.0, Oracle Enterprise Manager Base Platform 13.2.0.0.0, and 13.3.0.0.0 are affected.
How does CVE-2018-1656 impact the IBM Java Runtime Environment's Diagnostic Tooling Framework for Java (DTFJ)?
CVE-2018-1656 allows path traversal attacks when extracting compressed dump files in the IBM Java Runtime Environment's Diagnostic Tooling Framework for Java (DTFJ) (IBM SDK, Java Technology Edition 6.0, 7.0, and 8.0).
How can I fix the vulnerability CVE-2018-1656?
To fix the vulnerability CVE-2018-1656, update your IBM SDK Java Technology Edition to a version that includes the necessary security patches.