CVE-2018-8009

Published: Nov 13, 2018Modified: Jun 17, 2026

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the zip slip vulnerability in places that accept a zip file.

Affected (12)

Products: Apache: Hadoop

1 product

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Apache Hadoop	0.23.0 ≤ version ≤ 0.23.11
Apache Hadoop	2.0.0 ≤ version ≤ 2.7.6
Apache Hadoop	2.8.0 ≤ version ≤ 2.8.4
Apache Hadoop	2.9.0 ≤ version ≤ 2.9.1
Apache Hadoop	3.0.0 ≤ version ≤ 3.0.2
Apache Hadoop	Version 2.0.0 alpha
Apache Hadoop	Version 3.0.0 alpha1
Apache Hadoop	Version 3.0.0 alpha2
Apache Hadoop	Version 3.0.0 alpha3
Apache Hadoop	Version 3.0.0 alpha4
Apache Hadoop	Version 3.0.0 beta1
Apache Hadoop	Version 3.1.0

Related CWEs

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (16)

http://www.securityfocus.com/bid/105927

Source: security@apache.org

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2019:3892

Source: security@apache.org

https://hadoop.apache.org/cve_list.html#cve-2018-8009-http-cve-mitre-org-cgi-bin-cvename-cgi-name-cve-2018-8009-zip-slip-impact-on-apache-hadoop

Source: security@apache.org

Vendor Advisory

https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/a1c227745ce30acbcf388c5b0cc8423e8bf495d619cd0fa973f7f38d%40%3Cuser.hadoop.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r4dddf1705dbedfa94392913b2dad1cd2d1d89040facd389eea0b3510%40%3Ccommits.druid.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rb21df54a4e39732ce653d2aa5672e36a792b59eb6717f2a06bb8d02a%40%3Ccommits.druid.apache.org%3E

Source: security@apache.org

https://snyk.io/research/zip-slip-vulnerability

Source: security@apache.org

ExploitThird Party Advisory

http://www.securityfocus.com/bid/105927

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2019:3892

Source: af854a3a-2127-422b-91ae-364da2661108

https://hadoop.apache.org/cve_list.html#cve-2018-8009-http-cve-mitre-org-cgi-bin-cvename-cgi-name-cve-2018-8009-zip-slip-impact-on-apache-hadoop

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/a1c227745ce30acbcf388c5b0cc8423e8bf495d619cd0fa973f7f38d%40%3Cuser.hadoop.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/r4dddf1705dbedfa94392913b2dad1cd2d1d89040facd389eea0b3510%40%3Ccommits.druid.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/rb21df54a4e39732ce653d2aa5672e36a792b59eb6717f2a06bb8d02a%40%3Ccommits.druid.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://snyk.io/research/zip-slip-vulnerability

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.