A vulnerability has been found in the way developers have implemented the archive extraction of files. An arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar,xz, war, cpio, 7z), that holds path traversal filenames. So when the filename gets concatenated to the target extraction directory, the final path ends up outside of the target folder. Of course if an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily. This affects multiple libraries that lacks of a high level APIs that provide the archive extraction functionality. References: https://snyk.io/research/zip-slip-vulnerability Patch: https://github.com/apache/hadoop/commit/745f203e577bacb35b042206db94615141fa5e6f#diff-19cfa944d1bb9ce1daa46aa4223f3642
Created hadoop tracking bugs for this issue: Affects: fedora-all [bug 1593020]
This flaw affects FileUtil.java in apache hadoop. It does not affect rhs-hadoop package shipped in Red Hat Gluster Storage 3. Util class in Util.java of rhs-hadoop imports FileUtil from apache-hadoop but does not implement any of its function. ~]$ cat glusterfs-hadoop/src/main/java/org/apache/hadoop/fs/glusterfs/Util.java Util.java ... import org.apache.hadoop.fs.FileUtil; ... public class Util{ ... } So all affected code is outside of rhs-hadoop package
Statement: This issue did not affect the versions of rhs-hadoop as shipped with Red Hat Gluster Storage 3. For JBoss Fuse 6.3 and 7 standalone, while they ship vulnerable artifact via camel-hbase, camel-hdfs2 (fuse 6.3) and camel-hdfs2 (fuse 7), there's no invocation on the flawed code that could lead to an unzip operation. So fuse 6.3, 7 standalone are not affected. However FIS 2.0 and Fuse 7 on OpenShift ship vulnerable artifact via maven BOM, so setting fuse as affected for this reason.
What is the Hadoop version containing the fix?
Now the CVE list for Apache Hadoop is out. https://hadoop.apache.org/cve_list.html Please check the list for the versions containing the fix.
This issue has been addressed in the following products: Red Hat Fuse 7.5.0 Via RHSA-2019:3892 https://access.redhat.com/errata/RHSA-2019:3892