Description
An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4
Remediation
References
https://lists.apache.org/thread.html/r8d45e74299897b6734dd0f788c46a631009ce2eeb731523386f7a253%40%3Cuser.storm.apache.org%3E
https://seclists.org/oss-sec/2021/q4/45
Related Vulnerabilities
CVE-2022-31367 Vulnerability in npm package strapi
CVE-2023-31453 Vulnerability in maven package org.apache.inlong:manager-service
CVE-2018-6356 Vulnerability in maven package org.jenkins-ci.main:jenkins-core
CVE-2020-26217 Vulnerability in maven package xstream:xstream
CVE-2022-43435 Vulnerability in maven package org.jenkins-ci.plugins.plugin:fireline