CVE-2018-8021
First published: Wed Nov 07 2018(Updated: )
Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note Superset 0.23 was released prior to any Superset release under the Apache Software Foundation.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/superset | <0.23 | 0.23 |
| Apache Superset | <0.23 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2018-8021
- https://www.exploit-db.com/exploits/45933/
- https://github.com/apache/superset/pull/4243
- https://github.com/apache/superset/commit/2c72a7ae4fc0a8bac1f037a79efa90e1c5549710
- https://github.com/advisories/GHSA-vxp9-wv2f-wqmw (Advisory)
- https://github.com/apache/incubator-superset/pull/4243
- https://github.com/pypa/advisory-database/tree/main/vulns/superset/PYSEC-2018-74.yaml
- https://www.exploit-db.com/exploits/45933
Frequently Asked Questions
What is CVE-2018-8021?
CVE-2018-8021 is a vulnerability in Superset versions prior to 0.23 which allows for possible remote code execution.
How severe is CVE-2018-8021?
CVE-2018-8021 has a severity rating of 9.8 (Critical).
How does CVE-2018-8021 affect Superset?
CVE-2018-8021 affects Superset versions prior to 0.23.
Is there a fix available for CVE-2018-8021?
Yes, Superset 0.23 and above are not affected by CVE-2018-8021.
Where can I find more information about CVE-2018-8021?
More information about CVE-2018-8021 can be found on the NVD website.
- collector/nvd-index
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/remedy
- agent/event
- agent/first-publish-date
- agent/description
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-vxp9-wv2f-wqmw
- alias/CVE-2018-8021
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/references
- collector/nvd-cve
- source/NVD
- agent/tags
- collector/github-advisory
- vendor/apache
- canonical/apache superset
- package-manager/pip