GitHub Advisoryadvisory · Maven

GHSA-25pc-85qf-6j69 Deserialization of Untrusted Data in Apache Storm

CRITICAL Published 2019-08-01 Modified 2021-08-17 Official page ↗
Aliases
CVE-2018-11779
Ecosystem
Maven
Packages
org.apache.storm:storm-kafka, org.apache.storm:storm-kafka-client
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2019-08-01

Affected packages

• Maven org.apache.storm:storm-kafka: >= 1.1.0, < 1.2.3 → fixed in 1.2.3 • Maven org.apache.storm:storm-kafka-client: >= 1.1.0, < 1.2.3 → fixed in 1.2.3

Description

In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class.

Related

Alias · CVE (1)

  • CVE-2018-11779 In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References