Strix
26.1K

CVE-2018-8009

UnknownEPSS 7.58%

Last modified

CVE-2018-8009 is a vulnerability of currently unknown severity. Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the zip slip vulnerability in places that accept a zip file.. EPSS estimates a 7.58% chance of exploitation in the next 30 days.

Description

Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the zip slip vulnerability in places that accept a zip file.

Metrics

EPSS Probability
7.58%

93.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersionsUpdate
ApacheHadoop>= 0.23.0, <= 0.23.11—
ApacheHadoop>= 2.0.0, <= 2.7.6—
ApacheHadoop>= 2.8.0, <= 2.8.4—
ApacheHadoop>= 2.9.0, <= 2.9.1—
ApacheHadoop>= 3.0.0, <= 3.0.2—
ApacheHadoop2.0.0Alpha
ApacheHadoop3.0.0Alpha1
ApacheHadoop3.1.0—

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2018-8009?
Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the zip slip vulnerability in places that accept a zip file.
How severe is CVE-2018-8009?
Severity scoring for CVE-2018-8009 is pending analysis. The EPSS model estimates a 7.58% probability of exploitation in the next 30 days.
How do I fix CVE-2018-8009?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2018-8009?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST