Description
An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4
Remediation
References
https://lists.apache.org/thread.html/r8d45e74299897b6734dd0f788c46a631009ce2eeb731523386f7a253%40%3Cuser.storm.apache.org%3E
https://seclists.org/oss-sec/2021/q4/45
Related Vulnerabilities
CVE-2023-26474 Vulnerability in maven package org.xwiki.platform:xwiki-platform-oldcore
CVE-2022-36909 Vulnerability in maven package org.jenkins-ci.plugins:openshift-deployer
CVE-2021-39227 Vulnerability in npm package zrender
CVE-2021-25978 Vulnerability in npm package apostrophe
CVE-2020-7238 Vulnerability in maven package io.netty:netty-codec-http