Bug 1593018 (CVE-2018-8009) - CVE-2018-8009 hadoop: arbitrary file write vulnerability / arbitrary code execution using a specially crafted zip file
Summary: CVE-2018-8009 hadoop: arbitrary file write vulnerability / arbitrary code exe...
Alias: CVE-2018-8009
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1593020
Blocks: 1593021
TreeView+ depends on / blocked
Reported: 2018-06-19 21:04 UTC by Laura Pardo
Modified: 2021-02-17 00:06 UTC (History)
16 users (show)

Fixed In Version: hadoop 3.1.1, hadoop 3.0.3, hadoop 2.9.2, hadoop 2.8.5, hadoop 2.7.7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2018-06-20 06:19:16 UTC

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:3892 0 None None None 2019-11-14 21:17:59 UTC

Description Laura Pardo 2018-06-19 21:04:45 UTC
A vulnerability has been found in the way developers have implemented the archive extraction of files. An arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar,xz, war, cpio, 7z), that holds path traversal filenames. So when the filename gets concatenated to the target extraction directory, the final path ends up outside of the target folder. Of course if an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily. This affects multiple libraries that lacks of a high level APIs that provide the archive extraction functionality.



Comment 1 Laura Pardo 2018-06-19 21:06:20 UTC
Created hadoop tracking bugs for this issue:

Affects: fedora-all [bug 1593020]

Comment 2 Siddharth Sharma 2018-06-20 06:17:19 UTC
This flaw affects FileUtil.java in apache hadoop. It does not affect rhs-hadoop package shipped in Red Hat Gluster Storage 3. Util class in Util.java of rhs-hadoop imports FileUtil from apache-hadoop but does not implement any of its function. 

~]$ cat glusterfs-hadoop/src/main/java/org/apache/hadoop/fs/glusterfs/Util.java
import org.apache.hadoop.fs.FileUtil;

public class Util{

So all affected code is outside of rhs-hadoop package

Comment 4 Siddharth Sharma 2018-06-20 06:22:28 UTC

This issue did not affect the versions of rhs-hadoop as shipped with Red Hat Gluster Storage 3. For JBoss Fuse 6.3 and 7 standalone, while they ship vulnerable artifact via camel-hbase, camel-hdfs2 (fuse 6.3) and camel-hdfs2 (fuse 7), there's no invocation on the flawed code that could lead to an unzip operation. So fuse 6.3, 7 standalone are not affected. However FIS 2.0 and Fuse 7 on OpenShift ship vulnerable artifact via maven BOM, so setting fuse as affected for this reason.

Comment 7 Andrea Cosentino 2018-10-24 06:19:14 UTC
What is the Hadoop version containing the fix?

Comment 8 Akira Ajisaka 2018-10-30 05:59:50 UTC
Now the CVE list for Apache Hadoop is out.

Please check the list for the versions containing the fix.

Comment 9 errata-xmlrpc 2019-11-14 21:17:58 UTC
This issue has been addressed in the following products:

  Red Hat Fuse 7.5.0

Via RHSA-2019:3892 https://access.redhat.com/errata/RHSA-2019:3892

Note You need to log in before you can comment on or make changes to this bug.