CVE-2018-8008: Path Traversal
First published: Tue Jun 05 2018(Updated: )
Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cpio, 7z), that holds path traversal filenames. So when the filename gets concatenated to the target extraction directory, the final path ends up outside of the target folder.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Storm | <=1.0.6 | |
| Apache Storm | <=1.1.2 | |
| Apache Storm | <=1.2.1 | |
| maven/org.apache.storm:storm-core | <1.0.7 | 1.0.7 |
| maven/org.apache.storm:storm-core | >=1.1.0<1.1.3 | 1.1.3 |
| maven/org.apache.storm:storm-core | >=1.2.0<1.2.2 | 1.2.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/104418
- https://lists.apache.org/thread.html/613b2fca8bcd0a3b12c0b763ea8f7cf62e422e9f79fce6cfa5b08a58@%3Cdev.storm.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2018-8008
- https://github.com/advisories/GHSA-898j-5cc8-cmf5 (Advisory)
- https://github.com/apache/storm/commit/0fc6b522487c061f89e8cdacf09f722d3f20589
- https://github.com/apache/storm/commit/efad4cca2d7d461f5f8c08a0d7b51fabeb82d0a
- https://github.com/apache/storm/commit/f61e5daf299d6c37c7ad65744d02556c94a16a4
- https://issues.apache.org/jira/browse/STORM-3052
- https://lists.apache.org/thread.html/613b2fca8bcd0a3b12c0b763ea8f7cf62e422e9f79fce6cfa5b08a58%40%3Cdev.storm.apache.org%3E
Frequently Asked Questions
What is Apache Storm version 1.0.6 and earlier 1.2.1 and earlier and version 1.1.2 and earlier?
Apache Storm is a distributed real-time computation system for processing large amounts of data.
What is a zip archive?
A zip archive is a file format used to compress and package multiple files or directories into a single file.
How does Apache Storm expose an arbitrary file write vulnerability?
Apache Storm exposes an arbitrary file write vulnerability by not properly handling specially crafted zip archives that contain path traversal filenames.
What is the severity of CVE-2018-8008?
The severity of CVE-2018-8008 is medium with a CVSS score of 5.5.
How can I fix CVE-2018-8008?
To fix CVE-2018-8008, update to Apache Storm version 1.0.7, 1.1.3, or 1.2.2 or later.
- collector/nvd-index
- agent/type
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-898j-5cc8-cmf5
- alias/CVE-2018-8008
- agent/software-canonical-lookup
- agent/severity
- agent/weakness
- agent/softwarecombine
- agent/remedy
- agent/description
- collector/nvd-cve
- source/NVD
- agent/references
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/tags
- agent/first-publish-date
- agent/trending
- vendor/apache
- canonical/apache storm
- version/apache storm/1.0.6
- version/apache storm/1.1.2
- version/apache storm/1.2.1
- package-manager/maven