Description

An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4

Remediation

References

https://seclists.org/oss-sec/2021/q4/45

https://lists.apache.org/thread.html/r8d45e74299897b6734dd0f788c46a631009ce2eeb731523386f7a253%40%3Cuser.storm.apache.org%3E

Related Vulnerabilities

CVE-2021-3918 Vulnerability in npm package json-schema

CVE-2019-1003068 Vulnerability in maven package com.inkysea.vmware.vra:vmware-vrealize-automation-plugin

CVE-2019-0187 Vulnerability in maven package org.apache.jmeter:apachejmeter_core

CVE-2015-3250 Vulnerability in maven package org.apache.directory.api:apache-ldap-api

CVE-2017-9735 Vulnerability in maven package org.eclipse.jetty:jetty-util

Severity

Critical

Classification

CWE-502 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Third Party Advisory Vendor Advisory