Description
An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4
Remediation
References
https://lists.apache.org/thread.html/r8d45e74299897b6734dd0f788c46a631009ce2eeb731523386f7a253%40%3Cuser.storm.apache.org%3E
https://seclists.org/oss-sec/2021/q4/45
Related Vulnerabilities
CVE-2022-31147 Vulnerability in maven package org.webjars.npm:jquery-validation
CVE-2015-8851 Vulnerability in maven package org.webjars.bower:node-uuid
CVE-2023-26487 Vulnerability in npm package vega-functions
CVE-2023-27564 Vulnerability in npm package n8n
CVE-2019-10380 Vulnerability in maven package org.jenkins-ci.plugins:simple-travis-runner