Description
An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4
Remediation
References
https://lists.apache.org/thread.html/r8d45e74299897b6734dd0f788c46a631009ce2eeb731523386f7a253%40%3Cuser.storm.apache.org%3E
https://seclists.org/oss-sec/2021/q4/45
Related Vulnerabilities
CVE-2022-41225 Vulnerability in maven package org.jenkins-ci.plugins:anchore-container-scanner
CVE-2022-41253 Vulnerability in maven package org.jenkins-ci.plugins:cons3rt
CVE-2022-40705 Vulnerability in maven package soap:soap
CVE-2020-2137 Vulnerability in maven package org.jenkins-ci.plugins:timestamper