GitHub Advisoryadvisory · Maven

GHSA-w729-7633-2fw5 Deserialization of Untrusted Data leading to Remote Code Execution in Apache Storm

CRITICAL Published 2021-10-27 Modified 2021-10-29 Official page ↗
Aliases
CVE-2021-40865
Ecosystem
Maven
Packages
org.apache.storm:storm
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2021-10-26

Affected packages

• Maven org.apache.storm:storm: >= 2.2.0, < 2.2.1 → fixed in 2.2.1 • Maven org.apache.storm:storm: >= 1.0.0, < 1.2.4 → fixed in 1.2.4 • Maven org.apache.storm:storm: >= 2.1.0, < 2.1.1 → fixed in 2.1.1

Description

An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4

Related

Alias · CVE (1)

  • CVE-2021-40865 An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References