CVE-2018-1656: Path Traversal
First published: Thu Aug 16 2018(Updated: )
The IBM Java Runtime Environment's Diagnostic Tooling Framework for Java (DTFJ) (IBM SDK, Java Technology Edition 6.0 , 7.0, and 8.0) does not protect against path traversal attacks when extracting compressed dump files. IBM X-Force ID: 144882.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ibm Sdk | =6.0 | |
| Ibm Sdk | =7.0 | |
| Ibm Sdk | =8.0 | |
| Redhat Satellite | =5.6 | |
| Redhat Satellite | =5.7 | |
| Redhat Satellite | =5.8 | |
| Redhat Enterprise Linux Desktop | =6.0 | |
| Redhat Enterprise Linux Desktop | =7.0 | |
| Redhat Enterprise Linux Server | =6.0 | |
| Redhat Enterprise Linux Server | =7.0 | |
| Redhat Enterprise Linux Workstation | =6.0 | |
| Redhat Enterprise Linux Workstation | =7.0 | |
| Oracle Enterprise Manager Base Platform | =13.2.0.0.0 | |
| Oracle Enterprise Manager Base Platform | =13.3.0.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.ibm.com/support/docview.wss?uid=ibm10719653
- http://www.securityfocus.com/bid/105118
- http://www.securitytracker.com/id/1041765
- https://access.redhat.com/errata/RHSA-2018:2568
- https://access.redhat.com/errata/RHSA-2018:2569
- https://access.redhat.com/errata/RHSA-2018:2575
- https://access.redhat.com/errata/RHSA-2018:2576
- https://access.redhat.com/errata/RHSA-2018:2712
- https://access.redhat.com/errata/RHSA-2018:2713
- https://exchange.xforce.ibmcloud.com/vulnerabilities/144882
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www-01.ibm.com/support/docview.wss?uid=ibm10719653
- https://developer.ibm.com/javasdk/support/security-vulnerabilities/#IBM_Security_Update_August_2018
- https://bugzilla.redhat.com/show_bug.cgi?id=1618869
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2018-1656.
What is the severity of CVE-2018-1656?
The severity of CVE-2018-1656 is high with a CVSS score of 6.5.
Which software versions are affected by CVE-2018-1656?
IBM SDK Java Technology Edition 6.0, 7.0, and 8.0, as well as Redhat Satellite 5.6, 5.7, 5.8, Redhat Enterprise Linux Desktop 6.0, 7.0, Redhat Enterprise Linux Server 6.0, 7.0, Redhat Enterprise Linux Workstation 6.0, 7.0, Oracle Enterprise Manager Base Platform 13.2.0.0.0, and 13.3.0.0.0 are affected.
How does CVE-2018-1656 impact the IBM Java Runtime Environment's Diagnostic Tooling Framework for Java (DTFJ)?
CVE-2018-1656 allows path traversal attacks when extracting compressed dump files in the IBM Java Runtime Environment's Diagnostic Tooling Framework for Java (DTFJ) (IBM SDK, Java Technology Edition 6.0, 7.0, and 8.0).
How can I fix the vulnerability CVE-2018-1656?
To fix the vulnerability CVE-2018-1656, update your IBM SDK Java Technology Edition to a version that includes the necessary security patches.
- collector/nvd-index
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/softwarecombine
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2018-1656
- agent/remedy
- agent/weakness
- agent/severity
- agent/references
- agent/author
- agent/tags
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- vendor/ibm
- canonical/ibm sdk
- version/ibm sdk/6.0
- version/ibm sdk/7.0
- version/ibm sdk/8.0
- vendor/redhat
- canonical/redhat satellite
- version/redhat satellite/5.6
- version/redhat satellite/5.7
- version/redhat satellite/5.8
- canonical/redhat enterprise linux desktop
- version/redhat enterprise linux desktop/6.0
- version/redhat enterprise linux desktop/7.0
- canonical/redhat enterprise linux server
- version/redhat enterprise linux server/6.0
- version/redhat enterprise linux server/7.0
- canonical/redhat enterprise linux workstation
- version/redhat enterprise linux workstation/6.0
- version/redhat enterprise linux workstation/7.0
- vendor/oracle
- canonical/oracle enterprise manager base platform
- version/oracle enterprise manager base platform/13.2.0.0.0
- version/oracle enterprise manager base platform/13.3.0.0.0