Advisoriesby IbisstormGHSA-w729-7633-2fw5
Deserialization of Untrusted Data leading to Remote Code Execution in Apache Storm
Fix: upgrade to 1.2.4 or later (3 fixed versions below)
An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.storm:storm Maven | >= 2.2.0, < 2.2.1 | 2.2.1 |
| >= 1.0.0, < 1.2.4 | 1.2.4 | |
| >= 2.1.0, < 2.1.1 | 2.1.1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-502
- Also known as
- CVE-2021-40865