Bug 1593018 (CVE-2018-8009)

Summary:	CVE-2018-8009 hadoop: arbitrary file write vulnerability / arbitrary code execution using a specially crafted zip file
Product:	[Other] Security Response	Reporter:	Laura Pardo <lpardo>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aajisaka, acosenti, bchilds, bigdata-qe-bugs, chazlett, ctubbsii, denis.arnaud_fedora, eboyd, hghasemb, matt, milleruntime, rhs-bugs, sisharma, smohan, ssaha, vbellur
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	hadoop 3.1.1, hadoop 3.0.3, hadoop 2.9.2, hadoop 2.8.5, hadoop 2.7.7	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-06-20 06:19:16 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1593020
Bug Blocks:	1593021

Description Laura Pardo 2018-06-19 21:04:45 UTC

A vulnerability has been found in the way developers have implemented the archive extraction of files. An arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar,xz, war, cpio, 7z), that holds path traversal filenames. So when the filename gets concatenated to the target extraction directory, the final path ends up outside of the target folder. Of course if an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily. This affects multiple libraries that lacks of a high level APIs that provide the archive extraction functionality.


References:
https://snyk.io/research/zip-slip-vulnerability

Patch:
https://github.com/apache/hadoop/commit/745f203e577bacb35b042206db94615141fa5e6f#diff-19cfa944d1bb9ce1daa46aa4223f3642

Comment 1 Laura Pardo 2018-06-19 21:06:20 UTC

Created hadoop tracking bugs for this issue:

Affects: fedora-all [bug 1593020]

Comment 2 Siddharth Sharma 2018-06-20 06:17:19 UTC

This flaw affects FileUtil.java in apache hadoop. It does not affect rhs-hadoop package shipped in Red Hat Gluster Storage 3. Util class in Util.java of rhs-hadoop imports FileUtil from apache-hadoop but does not implement any of its function. 

~]$ cat glusterfs-hadoop/src/main/java/org/apache/hadoop/fs/glusterfs/Util.java
Util.java
...
import org.apache.hadoop.fs.FileUtil;
...

public class Util{
...
}

So all affected code is outside of rhs-hadoop package

Comment 4 Siddharth Sharma 2018-06-20 06:22:28 UTC

Statement:

This issue did not affect the versions of rhs-hadoop as shipped with Red Hat Gluster Storage 3. For JBoss Fuse 6.3 and 7 standalone, while they ship vulnerable artifact via camel-hbase, camel-hdfs2 (fuse 6.3) and camel-hdfs2 (fuse 7), there's no invocation on the flawed code that could lead to an unzip operation. So fuse 6.3, 7 standalone are not affected. However FIS 2.0 and Fuse 7 on OpenShift ship vulnerable artifact via maven BOM, so setting fuse as affected for this reason.

Comment 7 Andrea Cosentino 2018-10-24 06:19:14 UTC

What is the Hadoop version containing the fix?

Comment 8 Akira Ajisaka 2018-10-30 05:59:50 UTC

Now the CVE list for Apache Hadoop is out.
https://hadoop.apache.org/cve_list.html

Please check the list for the versions containing the fix.

Comment 9 errata-xmlrpc 2019-11-14 21:17:58 UTC

This issue has been addressed in the following products:

  Red Hat Fuse 7.5.0

Via RHSA-2019:3892 https://access.redhat.com/errata/RHSA-2019:3892