PT-2018-18378 · Apache · Apache Storm

Published

2018-06-05

·

Updated

2018-10-16

·

CVE-2018-8008

CVSS v2.0

5.8

Medium

VectorAV:N/AC:M/Au:N/C:N/I:P/A:P
Name of the Vulnerable Software and Affected Versions: Apache Storm versions 1.0.6 and earlier Apache Storm versions 1.2.1 and earlier Apache Storm version 1.1.2 and earlier
Description: The issue allows for an arbitrary file write, which can be achieved by using a specially crafted zip archive, as well as other archives like bzip2, tar, xz, war, cpio, and 7z. These archives can contain path traversal filenames. When the filename is concatenated to the target extraction directory, the final path ends up outside of the target folder.
Recommendations: For Apache Storm versions 1.0.6 and earlier, update to a version later than 1.0.6 to resolve the issue. For Apache Storm versions 1.2.1 and earlier, update to a version later than 1.2.1 to resolve the issue. For Apache Storm version 1.1.2 and earlier, update to a version later than 1.1.2 to resolve the issue. As a temporary workaround, consider restricting the use of archive files, especially those with path traversal filenames, until a patch is available.

Fix

Path traversal

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2018-8008
GHSA-898J-5CC8-CMF5

Affected Products

Apache Storm