GHSA-6x48-j4x4-cqw3

Source

https://github.com/advisories/GHSA-6x48-j4x4-cqw3

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/12/GHSA-6x48-j4x4-cqw3/GHSA-6x48-j4x4-cqw3.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-6x48-j4x4-cqw3

Aliases

CVE-2018-8009

Published

2018-12-21T17:50:29Z

Modified

2024-03-04T23:00:53.812358Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Path Traversal in Hadoop

Details

Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the zip slip vulnerability in places that accept a zip file.

Database specific

{
    "github_reviewed_at": "2020-06-16T21:20:31Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-22"
    ],
    "nvd_published_at": null
}

References

Affected packages

Maven

org.apache.hadoop:hadoop-main

Package

Name: org.apache.hadoop:hadoop-main; View open source insights on deps.dev
Purl: pkg:maven/org.apache.hadoop/hadoop-main

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.1.0

Fixed

3.1.1

Affected versions

3.*

3.1.0

org.apache.hadoop:hadoop-main

Package

Name: org.apache.hadoop:hadoop-main; View open source insights on deps.dev
Purl: pkg:maven/org.apache.hadoop/hadoop-main

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.0.0

Fixed

3.0.3

Affected versions

3.*

3.0.0

3.0.1

3.0.2

org.apache.hadoop:hadoop-main

Package

Name: org.apache.hadoop:hadoop-main; View open source insights on deps.dev
Purl: pkg:maven/org.apache.hadoop/hadoop-main

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.9.0

Fixed

2.9.2

Affected versions

2.*

2.9.0

2.9.1

org.apache.hadoop:hadoop-main

Package

Name: org.apache.hadoop:hadoop-main; View open source insights on deps.dev
Purl: pkg:maven/org.apache.hadoop/hadoop-main

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.8.0

Fixed

2.8.5

Affected versions

2.*

2.8.0

2.8.1

2.8.2

2.8.3

2.8.4

org.apache.hadoop:hadoop-main

Package

Name: org.apache.hadoop:hadoop-main; View open source insights on deps.dev
Purl: pkg:maven/org.apache.hadoop/hadoop-main

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.7.7

Affected versions

0.*

0.23.1

0.23.3

0.23.4

0.23.5

0.23.6

0.23.7

0.23.8

0.23.9

0.23.10

0.23.11

2.*

2.0.0-alpha

2.0.1-alpha

2.0.2-alpha

2.0.3-alpha

2.0.4-alpha

2.0.5-alpha

2.0.6-alpha

2.1.0-beta

2.1.1-beta

2.2.0

2.3.0

2.4.0

2.4.1

2.5.0

2.5.1

2.5.2

2.6.0

2.6.1

2.6.2

2.6.3

2.6.4

2.6.5

2.7.0

2.7.1

2.7.2

2.7.3

2.7.4

2.7.5

2.7.6