critical9.8
CVE-2021-40865
Deserialization of Untrusted Data leading to Remote Code Execution in Apache Storm
Impact
An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.storm:storm | >= 2.2.0, < 2.2.1 | 2.2.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Storm | from 1.0.0 before 1.2.4 from 2.1.0 before 2.1.1 from 2.2.0 before 2.2.1 |