Vulnerability · Published Oct 25, 2021 · Assigned by apache
CVE-2021-40865Unsafe Pre-Authentication Deserialization In Workers
Critical 9.8
In plain English
A critical-severity unsafe deserialization in Apache Storm from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 64.2% (higher than 99.2% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.storm:storm | 2.2.1 | GHSA-w729-7633-2fw5 |
| Maven | org.apache.storm:storm | 1.2.4 | GHSA-w729-7633-2fw5 |
| Maven | org.apache.storm:storm | 2.1.1 | GHSA-w729-7633-2fw5 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Storm | v1.0.0 – before Apache Storm *Apache Storm – before v1.2.4 |
Weakness: CWE-502