Deserialization of Untrusted Data leading to Remote Code Execution in Apache Storm
Critical severity
GitHub Reviewed
Published
Oct 27, 2021
to the GitHub Advisory Database
•
Updated Feb 1, 2023
Package
Affected versions
>= 2.2.0, < 2.2.1
>= 1.0.0, < 1.2.4
>= 2.1.0, < 2.1.1
Patched versions
2.2.1
1.2.4
2.1.1
Description
Published by the National Vulnerability Database
Oct 25, 2021
Reviewed
Oct 26, 2021
Published to the GitHub Advisory Database
Oct 27, 2021
Last updated
Feb 1, 2023
An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4
References