Not rated
CVE-2018-8009 Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is…
Description
Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the zip slip vulnerability in places that accept a zip file.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Hadoop | Versions not published |
References
- snyk.io snyk.io
- 105927 www.securityfocus.com
- [hadoop-user] 20181122 CVE-2018-8009: Apache Hadoop distributed cache archive vulnerability lists.apache.org
- hadoop.apache.org hadoop.apache.org
- [lucene-solr-user] 20190104 Re: SOLR v7 Security Issues Caused Denial of Use - Sonatype Application Composition Report lists.apache.org
- RHSA-2019:3892 access.redhat.com
- [druid-commits] 20201008 [druid] branch master updated: Suppress CVE-2018-11765 for hadoop dependencies (#10485) lists.apache.org
- [druid-commits] 20201008 [druid] branch 0.20.0 updated: Suppress CVE-2018-11765 for hadoop dependencies (#10485) (#10492) lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache Hadoop
The 18 CVEs of Apache Hadoop →
CVE-2024-23454
Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default
Not rated
CVE-2023-26031
Relative library resolution in linux container-executor binary in Apache Hadoop 3.3.1-3.3.4 on Linux allows local user…
Not rated
CVE-2021-25642
ZKConfigurationStore which is optionally used by CapacityScheduler of Apache Hadoop YARN deserializes data obtained from…
Not rated
CVE-2022-25168
Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell
Not rated