CVE-2018-8013 Deserialization of Untrusted Data in Apache Batik

What is CVE-2018-8013?

CVE-2018-8013 is a critical unsafe deserialization vulnerability in Canonical Ubuntu Linux, published on 24 May 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.

Weakness: CWE-502

Which versions are affected by CVE-2018-8013?

2 open source packages ship an affected version, including org.apache.xmlgraphics:batik. It affects 21 products.

Products include Apache Batik, Canonical Ubuntu Linux, Debian Debian Linux, Oracle Business Intelligence, Oracle Communications Diameter Signaling Router, Oracle Communications Metasolv Solution and 15 more.

How do I fix CVE-2018-8013?

Upgrade org.apache.xmlgraphics:batik to 1.10 or later.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2018-8013 being exploited?

There is no known exploitation of CVE-2018-8013 in the wild and no public exploit code.

Other vulnerabilities in Canonical Ubuntu Linux

• CVE-2020-11987 Server-side request forgery (SSRF) in Apache Batik High 8.2
• CVE-2022-41704 Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input High 7.5
• CVE-2022-42890 Apache Batik prior to 1.16 allows RCE via scripting High 7.5
• CVE-2022-40146 Jar url should be blocked by DefaultScriptSecurity High 7.5
• CVE-2019-17566 Server-side request forgery (SSRF) in Apache Batik High 7.5

All Canonical Ubuntu Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2018-8013, DLA-1385-1, GHSA-25gw-4pcc-45cf, UBUNTU-CVE-2018-8013, USN-3661-1.