EUVD-2018-0799

🗓️ 03 Oct 2025 20:07:09Reported by EUVDType

Apache Hadoop versions vulnerable to zip slip issue when handling zip files.

Reporter	Title	Published	Views	Family All 30
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities have been identified in DB2 that affect the IBM Performance Management product	20 May 202014:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Incident Forensics is vulnerable to using component with known vulnerabilities	7 Oct 202020:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Db2® Warehouse has released a fix in response to multiple vulnerabilities found in IBM Db2®	19 Apr 202116:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected but not classified as vulnerable to multiple vulnerabilities in Apache Hadoop	17 May 202321:55	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities have been identified in IBM® DB2® shipped with IBM PureData System for Operational Analytics	29 Apr 202501:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities including a remote code execution in Spring Framework (CVE-2022-22965)	11 Apr 202215:17	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of Spark from Hadoop, IBM Cloud Pak for Multicloud Management Monitoring could allow a remote attacker to traverse directories on the system.	5 Sep 202310:36	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in dependent libraries affect IBM® Db2® leading to denial of service or privilege escalation.	10 Mar 202121:20	–	ibm
Broadcom	BSA-2018-662	21 Jun 201800:00	–	broadcom
CNVD	Apache Hadoop Arbitrary File Write Vulnerability	15 Nov 201800:00	–	cnvd

[
  {
    "enisaIdVendor": [
      {
        "id": "3e2d08f4-0d45-3905-9d8a-fdf05487c5e8",
        "vendor": {
          "name": "Apache Software Foundation"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "9720161a-5385-3429-b9e4-98a1b2a1c92c",
        "product": {
          "name": "Apache Hadoop"
        },
        "product_version": "Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11"
      }
    ]
  }
]

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2018-8009
github	www.github.com/apache/hadoop/commit/12258c7cff8d32710fbd8b9088a930e3ce27432
github	www.github.com/apache/hadoop/commit/45a1c680c276c4501402f7bc4cebcf85a6fbc7f
github	www.github.com/apache/hadoop/commit/65e55097da2bb3f2fbdf9ba1946da25fe58bec9
github	www.github.com/apache/hadoop/commit/6a4ae6f6eeed1392a4828a5721fa1499f65bdde
github	www.github.com/apache/hadoop/commit/fc4c20fc3469674cb584a4fb98bac7e3c2277c9
access	www.access.redhat.com/errata/RHSA-2019:3892
github	www.github.com/advisories/GHSA-6x48-j4x4-cqw3
github	www.github.com/apache/hadoop
hadoop	www.hadoop.apache.org/cve_list.html

03 Oct 2025 20:07Current

8.6High risk

Vulners AI Score8.6

CVSS 38.8

CVSS 26.5

EPSS0.04616