PT-2018-18386 · Apache+1 · Superset+1

David May · Published 2018-11-07 · Updated 2019-01-30 · CVE-2018-8021

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Superset versions prior to 0.23

Description: The issue is related to the use of an unsafe load method from the pickle library to deserialize data, which can lead to possible remote code execution.

Recommendations: For versions prior to 0.23, update to version 0.23 or later to resolve the issue.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2018-8021

GHSA-VXP9-WV2F-WQMW

PYSEC-2018-74

Affected Products

Superset

Pickle

References · 12

• 🔥 https://github.com/r3dxpl0it/Apache-Superset-Remote-Code-Execution-PoC-CVE-2018-8021 · Exploit
• 🔥 https://exploit-db.com/exploits/45933 · Exploit
• https://github.com/apache/incubator-superset/pull/4243 · Patch
• https://osv.dev/vulnerability/GHSA-vxp9-wv2f-wqmw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-8021 · Security Note
• https://osv.dev/vulnerability/PYSEC-2018-74 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-8021 · Vendor Advisory
• https://github.com/apache/superset · Note
• https://github.com/apache/superset/pull/4243 · Note
• https://github.com/apache/superset/commit/2c72a7ae4fc0a8bac1f037a79efa90e1c5549710 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/superset/PYSEC-2018-74.yaml · Note
• https://github.com/advisories/GHSA-vxp9-wv2f-wqmw · Note