Read the docs
TI-2018-05786 Aliases CVE-2018-8009GHSA-6x48-j4x4-cqw3

Path traversal in Apache Hadoop

Priority MEDIUM 48CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the zip slip vulnerability in places that accept a zip file.

Why it matters now

EPSS 0.06734 93rd percentileScored 2026-11-07
Fix Fixed org.apache.hadoop:hadoop-main (Maven): 3.1.1, 3.0.3, 2.9.2 +2Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache HadoopApache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11—No fix listedCNA
—org.apache.hadoop:hadoop-main (Maven)3.1.0 to before 3.1.13.1.1Patch availableGHSA-6x48-j4x4-cqw3
—org.apache.hadoop:hadoop-main (Maven)3.0.0 to before 3.0.33.0.3Patch availableGHSA-6x48-j4x4-cqw3
—org.apache.hadoop:hadoop-main (Maven)2.9.0 to before 2.9.22.9.2Patch availableGHSA-6x48-j4x4-cqw3
—org.apache.hadoop:hadoop-main (Maven)2.8.0 to before 2.8.52.8.5Patch availableGHSA-6x48-j4x4-cqw3
—org.apache.hadoop:hadoop-main (Maven)before 2.7.72.7.7Patch availableGHSA-6x48-j4x4-cqw3
  • Apache Hadoop VendorApache Affected Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 Fixed in — No fix listed CNA
  • org.apache.hadoop:hadoop-main (Maven) Vendor— Affected 3.1.0 to before 3.1.1 Fixed in 3.1.1 Patch available GHSA-6x48-j4x4-cqw3
  • org.apache.hadoop:hadoop-main (Maven) Vendor— Affected 3.0.0 to before 3.0.3 Fixed in 3.0.3 Patch available GHSA-6x48-j4x4-cqw3
  • org.apache.hadoop:hadoop-main (Maven) Vendor— Affected 2.9.0 to before 2.9.2 Fixed in 2.9.2 Patch available GHSA-6x48-j4x4-cqw3
  • org.apache.hadoop:hadoop-main (Maven) Vendor— Affected 2.8.0 to before 2.8.5 Fixed in 2.8.5 Patch available GHSA-6x48-j4x4-cqw3
  • org.apache.hadoop:hadoop-main (Maven) Vendor— Affected before 2.7.7 Fixed in 2.7.7 Patch available GHSA-6x48-j4x4-cqw3

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*0.23.0 – 0.23.11; 2.0.0 – 2.7.6; 2.8.0 – 2.8.4; 2.9.0 – 2.9.1; 3.0.0 – 3.0.2VulnerableApache
cpe:2.3:a:apache:hadoop:2.0.0:alpha:*:*:*:*:*:*2.0.0 alphaVulnerableApache
cpe:2.3:a:apache:hadoop:3.0.0:alpha1:*:*:*:*:*:*3.0.0 alpha1VulnerableApache
cpe:2.3:a:apache:hadoop:3.0.0:alpha2:*:*:*:*:*:*3.0.0 alpha2VulnerableApache
cpe:2.3:a:apache:hadoop:3.0.0:alpha3:*:*:*:*:*:*3.0.0 alpha3VulnerableApache
cpe:2.3:a:apache:hadoop:3.0.0:alpha4:*:*:*:*:*:*3.0.0 alpha4VulnerableApache
cpe:2.3:a:apache:hadoop:3.0.0:beta1:*:*:*:*:*:*3.0.0 beta1VulnerableApache
cpe:2.3:a:apache:hadoop:3.1.0:*:*:*:*:*:*:*3.1.0VulnerableApache
  • cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:* Versions 0.23.0 – 0.23.11; 2.0.0 – 2.7.6; 2.8.0 – 2.8.4; 2.9.0 – 2.9.1; 3.0.0 – 3.0.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:hadoop:2.0.0:alpha:*:*:*:*:*:* Versions 2.0.0 alpha Vulnerable ·Apache
  • cpe:2.3:a:apache:hadoop:3.0.0:alpha1:*:*:*:*:*:* Versions 3.0.0 alpha1 Vulnerable ·Apache
  • cpe:2.3:a:apache:hadoop:3.0.0:alpha2:*:*:*:*:*:* Versions 3.0.0 alpha2 Vulnerable ·Apache
  • cpe:2.3:a:apache:hadoop:3.0.0:alpha3:*:*:*:*:*:* Versions 3.0.0 alpha3 Vulnerable ·Apache
  • cpe:2.3:a:apache:hadoop:3.0.0:alpha4:*:*:*:*:*:* Versions 3.0.0 alpha4 Vulnerable ·Apache
  • cpe:2.3:a:apache:hadoop:3.0.0:beta1:*:*:*:*:*:* Versions 3.0.0 beta1 Vulnerable ·Apache
  • cpe:2.3:a:apache:hadoop:3.1.0:*:*:*:*:*:*:* Versions 3.1.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-6x48-j4x4-cqw3 org.apache.hadoop:hadoop-main (Maven) Fixed in 3.1.1 Advisory →
  • Fix · GHSA-6x48-j4x4-cqw3 org.apache.hadoop:hadoop-main (Maven) Fixed in 3.0.3 Advisory →
  • Fix · GHSA-6x48-j4x4-cqw3 org.apache.hadoop:hadoop-main (Maven) Fixed in 2.9.2 Advisory →
  • Fix · GHSA-6x48-j4x4-cqw3 org.apache.hadoop:hadoop-main (Maven) Fixed in 2.8.5 Advisory →
  • Fix · GHSA-6x48-j4x4-cqw3 org.apache.hadoop:hadoop-main (Maven) Fixed in 2.7.7 Advisory →

Red Hat 1 advisory

  • RHSA-2019:3892 Released 2019-11-14 · Red Hat rating Important
    Red Hat Fuse 7.5.0 security update
    • Red Hat Fuse 7.5.0

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7.5.0Fixed RHSA-2019:3892
Not affected: 2 products
  • Red Hat JBoss Fuse 6
  • Red Hat Storage 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-8009
  2. 2026-10-03 Alias added: GHSA-6x48-j4x4-cqw3

References

Advisory 4

Other 14

  • TI-2019-12818 Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while… CVSS 3.1CRITICAL 9.8
  • TI-2022-09898 Arbitrary file write in FileUtil#unpackEntries on Windows CVSS 3.1CRITICAL 9.8
  • TI-2022-08881 Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTar CVSS 3.1CRITICAL 9.8
  • TI-2021-15353 Heap buffer overflow in libhdfs native library CVSS 3.1CRITICAL 9.8
  • TI-2017-11489 Information disclosure in Apache Hadoop CVSS 3.0CRITICAL 9.8
  • TI-2016-02585 Information disclosure in Apache Hadoop CVSS 3.0CRITICAL 9.8
See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences