CVE-2018-8009: Path Traversal
A vulnerability has been found in the way developers have implemented the archive extraction of files. An arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar,xz, war, cpio, 7z), that holds path traversal filenames. So when the filename gets concatenated to the target extraction directory, the final path ends up outside of the target folder. Of course if an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily. This affects multiple libraries that lacks of a high level APIs that provide the archive extraction functionality.
References: https://snyk.io/research/zip-slip-vulnerability
Patch: https://github.com/apache/hadoop/commit/745f203e577bacb35b042206db94615141fa5e6f#diff-19cfa944d1bb9ce1daa46aa4223f3642
Other sources
Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the zip slip vulnerability in places that accept a zip file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.hadoop:hadoop-mainto a version that resolves this vulnerability.Fixed in 2.7.7 - Upgrade
Upgrade
maven/org.apache.hadoop:hadoop-mainto a version that resolves this vulnerability.Fixed in 2.8.5 - Upgrade
Upgrade
maven/org.apache.hadoop:hadoop-mainto a version that resolves this vulnerability.Fixed in 2.9.2 - Upgrade
Upgrade
maven/org.apache.hadoop:hadoop-mainto a version that resolves this vulnerability.Fixed in 3.0.3 - Upgrade
Upgrade
maven/org.apache.hadoop:hadoop-mainto a version that resolves this vulnerability.Fixed in 3.1.1 - Upgrade
Upgrade
redhat/hadoopto a version that resolves this vulnerability.Fixed in 3.1.1 - Upgrade
Upgrade
redhat/hadoopto a version that resolves this vulnerability.Fixed in 3.0.3 - Upgrade
Upgrade
redhat/hadoopto a version that resolves this vulnerability.Fixed in 2.9.2 - Upgrade
Upgrade
redhat/hadoopto a version that resolves this vulnerability.Fixed in 2.8.5 - Upgrade
Upgrade
redhat/hadoopto a version that resolves this vulnerability.Fixed in 2.7.7
Event History
Frequently Asked Questions
What is CVE-2018-8009?
CVE-2018-8009 is a vulnerability in Apache Hadoop versions 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, and 0.23.0 to 0.23.11.
How severe is CVE-2018-8009?
CVE-2018-8009 has a severity rating of 8.8, which is classified as high.
What is the zip slip vulnerability?
The zip slip vulnerability is a security issue where an attacker can exploit the extraction of ZIP files to overwrite arbitrary files on the file system.
How can I fix CVE-2018-8009?
You can fix CVE-2018-8009 by updating to Apache Hadoop version 3.1.1, 3.0.3, 2.9.2, 2.8.5, 2.7.7, or by applying the appropriate patches provided by Red Hat.
Where can I find more information about CVE-2018-8009?
You can find more information about CVE-2018-8009 on the Snyk research page, the GitHub commit, and the Red Hat Bugzilla page.