Path Traversal in Apache Hadoop
CVE-2018-8009
Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the zip slip vulnerability in places that accept a zip file.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.067 (94.0th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 94th percentile — 94.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.067 · newest: 0.067 · change: 0.000
Affected products
- Apache Hadoop — versions 2.0.0, 3.0.0, 3.1.0
- Apache Software Foundation Hadoop — versions Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11
Weakness classification (CWE)
Public proof-of-concept exploits
References
- snyk.io/research/zip-slip-vulnerability (Exploit, Third Party Advisory)
- www.securityfocus.com/bid/105927 (VDB Entry, Third Party Advisory, vdb-entry)
- lists.apache.org/thread.html/a1c227745ce30acbcf388c5b0cc8423e8bf495d619cd0fa973… (mailing-list)
- hadoop.apache.org/cve_list.html (Vendor Advisory)
- lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535… (mailing-list)
- access.redhat.com/errata/RHSA-2019:3892 (vendor-advisory)
- lists.apache.org/thread.html/r4dddf1705dbedfa94392913b2dad1cd2d1d89040facd389ee… (mailing-list)
- lists.apache.org/thread.html/rb21df54a4e39732ce653d2aa5672e36a792b59eb6717f2a06… (mailing-list)
Frequently asked questions
- What is CVE-2018-8009?
- CVE-2018-8009 is a high-severity vulnerability in Apache Hadoop, classified under Path Traversal. CVSS score: 8.8/10. Published 2018-11-13.
- How severe is CVE-2018-8009?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2018-8009 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.