GHSA-w729-7633-2fw5

Source

https://github.com/advisories/GHSA-w729-7633-2fw5

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/10/GHSA-w729-7633-2fw5/GHSA-w729-7633-2fw5.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-w729-7633-2fw5

Aliases

CVE-2021-40865

Published

2021-10-27T18:52:06Z

Modified

2023-11-08T04:06:49.748909Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Deserialization of Untrusted Data leading to Remote Code Execution in Apache Storm

Details

An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4

Database specific

{
    "nvd_published_at": "2021-10-25T13:15:00Z",
    "github_reviewed_at": "2021-10-26T17:53:48Z",
    "severity": "CRITICAL",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-502"
    ]
}

References

Affected packages

Maven / org.apache.storm:storm

Package

Name: org.apache.storm:storm; View open source insights on deps.dev
Purl: pkg:maven/org.apache.storm/storm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.2.0

Fixed

2.2.1

Affected versions

2.*

2.2.0

Maven / org.apache.storm:storm

Package

Name: org.apache.storm:storm; View open source insights on deps.dev
Purl: pkg:maven/org.apache.storm/storm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.0.0

Fixed

1.2.4

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.1.0

1.1.1

1.1.2

1.1.3

1.2.0

1.2.1

1.2.2

1.2.3

Maven / org.apache.storm:storm

Package

Name: org.apache.storm:storm; View open source insights on deps.dev
Purl: pkg:maven/org.apache.storm/storm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.1.0

Fixed

2.1.1

Affected versions

2.*

2.1.0