Skip to content
Fencer Vulns
high 7.4

CVE-2018-1656 json

The IBM Java Runtime Environment's Diagnostic Tooling Framework for Java (DTFJ) (IBM SDK, Java Technology Edition 6.0 , 7.0, and 8.0) does…

published 2018-08-20 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-12235

cvss
7.4
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
4.5%
EPSS 4.5% chance of exploitation in 30 days, percentile 91%
public exploits
0
none known

Summary

The IBM Java Runtime Environment's Diagnostic Tooling Framework for Java (DTFJ) (IBM SDK, Java Technology Edition 6.0 , 7.0, and 8.0) does not protect against path traversal attacks when extracting compressed dump files. IBM X-Force ID: 144882.

Patch / fix

  • java-1.7.1-ibm RHEL 6 EXTRAS, network satellite 5.7, network satellite 5.6 1:1.7.1.4.30-1jpp.2.el6_10
  • java-1.8.0-ibm RHEL 6 EXTRAS, network satellite 5.8 1:1.8.0.5.20-1jpp.1.el6_10
  • java-1.7.1-ibm RHEL 7 EXTRAS 1:1.7.1.4.30-1jpp.1.el7
  • java-1.7.1-ibm-src RHEL 7 EXTRAS 1:1.7.1.4.30-1jpp.1.el7
  • java-1.7.1-ibm-demo RHEL 7 EXTRAS 1:1.7.1.4.30-1jpp.1.el7
  • java-1.7.1-ibm-jdbc RHEL 7 EXTRAS 1:1.7.1.4.30-1jpp.1.el7
  • java-1.7.1-ibm-plugin RHEL 7 EXTRAS 1:1.7.1.4.30-1jpp.1.el7
  • java-1.7.1-ibm-src RHEL 6 EXTRAS 1:1.7.1.4.30-1jpp.2.el6_10

red hat advisories RHSA-2018:2712RHSA-2018:2713RHSA-2018:2569RHSA-2018:2576RHSA-2018:2575RHSA-2018:2568

  • java-1_7_1-ibm SLES 12 SP3, SLES 12 SP2-BCL, SLE Software Development Kit 12 SP3 +8 more 1.7.1_sr4.30-38.26.1
  • java-1_8_0-ibm SLES 12 SP3, SLES 12 SP2-BCL, SLE Software Development Kit 12 SP3 +7 more 1.8.0_sr5.20-30.36.1
  • java-1_8_0-ibm SLE Module for Legacy 15 1.8.0_sr5.20-3.6.2
  • java-1_7_1-ibm SLES for SAP 11 SP4, SLES 11 SP4, SLE Software Development Kit 11 SP4 1.7.1_sr4.30-26.29.1
  • java-1_7_0-ibm SLES 11 SP3-TERADATA, SLES 11 SP3-LTSS, SLE Point of Sale 11 SP3 1.7.0_sr10.30-65.28.1

suse advisories SUSE-SU-2018:2649-2SUSE-SU-2018:2839-2SUSE-SU-2018:3082-1SUSE-SU-2018:2839-1SUSE-SU-2018:2649-1SUSE-SU-2018:2583-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-1656 updated cvss 6.5

JDK: path traversal flaw in the Diagnostic Tooling Framework

  • Red Hat Enterprise Linux Client Supplementary (v. 7) java-1.7.1-ibm 1.7.1.4.30-1jpp.1.el7, java-1.8.0-ibm 1.8.0.5.20-1jpp.1.el7, java-1.7.1-ibm-src 1.7.1.4.30-1jpp.1.el7, java-1.8.0-ibm-src 1.8.0.5.20-1jpp.1.el7, java-1.7.1-ibm-demo 1.7.1.4.30-1jpp.1.el7, java-1.7.1-ibm-jdbc 1.7.1.4.30-1jpp.1.el7, +4 more Red Hat Enterprise Linux ComputeNode Supplementary (v. 7) java-1.7.1-ibm 1.7.1.4.30-1jpp.1.el7, java-1.8.0-ibm 1.8.0.5.20-1jpp.1.el7, java-1.7.1-ibm-src 1.7.1.4.30-1jpp.1.el7, java-1.8.0-ibm-src 1.8.0.5.20-1jpp.1.el7, java-1.7.1-ibm-demo 1.7.1.4.30-1jpp.1.el7, java-1.8.0-ibm-demo 1.8.0.5.20-1jpp.1.el7
    fixed: vendor fix RHSA-2018:2569
  • Red Hat Enterprise Linux Desktop Supplementary (v. 6) java-1.7.1-ibm 1.7.1.4.30-1jpp.2.el6_10, java-1.8.0-ibm 1.8.0.5.20-1jpp.1.el6_10, java-1.7.1-ibm-src 1.7.1.4.30-1jpp.2.el6_10, java-1.8.0-ibm-src 1.8.0.5.20-1jpp.1.el6_10, java-1.7.1-ibm-demo 1.7.1.4.30-1jpp.2.el6_10, java-1.7.1-ibm-jdbc 1.7.1.4.30-1jpp.2.el6_10, +4 more Red Hat Enterprise Linux HPC Node Supplementary (v. 6) java-1.7.1-ibm 1.7.1.4.30-1jpp.2.el6_10, java-1.8.0-ibm 1.8.0.5.20-1jpp.1.el6_10, java-1.7.1-ibm-src 1.7.1.4.30-1jpp.2.el6_10, java-1.8.0-ibm-src 1.8.0.5.20-1jpp.1.el6_10, java-1.7.1-ibm-demo 1.7.1.4.30-1jpp.2.el6_10, java-1.8.0-ibm-demo 1.8.0.5.20-1jpp.1.el6_10 Red Hat Enterprise Linux Server Supplementary (v. 6) java-1.7.1-ibm 1.7.1.4.30-1jpp.2.el6_10, java-1.8.0-ibm 1.8.0.5.20-1jpp.1.el6_10, java-1.7.1-ibm-src 1.7.1.4.30-1jpp.2.el6_10, java-1.8.0-ibm-src 1.8.0.5.20-1jpp.1.el6_10, java-1.7.1-ibm-demo 1.7.1.4.30-1jpp.2.el6_10, java-1.7.1-ibm-jdbc 1.7.1.4.30-1jpp.2.el6_10, +4 more
    fixed: vendor fix RHSA-2018:2576
  • Red Hat Enterprise Linux Server Supplementary (v. 7) java-1.7.1-ibm 1.7.1.4.30-1jpp.1.el7, java-1.8.0-ibm 1.8.0.5.20-1jpp.1.el7, java-1.7.1-ibm-src 1.7.1.4.30-1jpp.1.el7, java-1.8.0-ibm-src 1.8.0.5.20-1jpp.1.el7, java-1.7.1-ibm-demo 1.7.1.4.30-1jpp.1.el7, java-1.7.1-ibm-jdbc 1.7.1.4.30-1jpp.1.el7, +4 more
    fixed: vendor fix RHSA-2018:2569
  • Red Hat Enterprise Linux Workstation Supplementary (v. 6) java-1.7.1-ibm 1.7.1.4.30-1jpp.2.el6_10, java-1.8.0-ibm 1.8.0.5.20-1jpp.1.el6_10, java-1.7.1-ibm-src 1.7.1.4.30-1jpp.2.el6_10, java-1.8.0-ibm-src 1.8.0.5.20-1jpp.1.el6_10, java-1.7.1-ibm-demo 1.7.1.4.30-1jpp.2.el6_10, java-1.7.1-ibm-jdbc 1.7.1.4.30-1jpp.2.el6_10, +4 more
    fixed: vendor fix RHSA-2018:2576
  • Red Hat Enterprise Linux Workstation Supplementary (v. 7) java-1.7.1-ibm 1.7.1.4.30-1jpp.1.el7, java-1.8.0-ibm 1.8.0.5.20-1jpp.1.el7, java-1.7.1-ibm-src 1.7.1.4.30-1jpp.1.el7, java-1.8.0-ibm-src 1.8.0.5.20-1jpp.1.el7, java-1.7.1-ibm-demo 1.7.1.4.30-1jpp.1.el7, java-1.7.1-ibm-jdbc 1.7.1.4.30-1jpp.1.el7, +4 more
    fixed: vendor fix RHSA-2018:2569
  • Red Hat Satellite 5.6 (RHEL v.6) java-1.7.1-ibm 1.7.1.4.30-1jpp.2.el6_10 Red Hat Satellite 5.7 (RHEL v.6) java-1.7.1-ibm 1.7.1.4.30-1jpp.2.el6_10
    fixed: vendor fix RHSA-2018:2712
  • Red Hat Satellite 5.8 (RHEL v.6) java-1.8.0-ibm 1.8.0.5.20-1jpp.1.el6_10
    fixed: vendor fix RHSA-2018:2713

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

4.46% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 7.4 CVSS:3.0/A:N/AC:L/AV:N/C:N/I:H/PR:N/S:C/UI:R/E:U/RC:C/RL:O
CNA 3.0 7.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
NVD 3.0 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

  • IBM SDK, Java Technology Edition

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.