PT-2019-8799 · Apache · Apache Storm

Publicado 2019-07-25 · Atualizado 2020-11-12 · CVE-2018-11779

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Storm versions 1.1.0 through 1.2.2

Description The issue allows an attacker to cause the Storm UI daemon to deserialize user-provided bytes into a Java class when using the storm-kafka-client or storm-kafka modules.

Recommendations For Apache Storm versions 1.1.0 through 1.2.2, consider disabling the storm-kafka-client or storm-kafka modules until a patch is available to prevent the Storm UI daemon from deserializing user-provided bytes into a Java class. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2018-11779

GHSA-25PC-85QF-6J69

SUSE-SU-2020:2876-1

SUSE-SU-2020:3309-1

Produtos afetados

Apache Storm

Referências · 124

• https://suse.com/security/cve/CVE-2019-14864 · Nota
• https://suse.com/security/cve/CVE-2020-1735 · Nota
• https://t.me/cibsecurity/5724 · Publicação no Telegram
• https://bugzilla.suse.com/1097775 · Nota
• https://bugzilla.suse.com/1164133 · Nota
• https://suse.com/security/cve/CVE-2018-16837 · Nota
• https://suse.com/security/cve/CVE-2019-14905 · Nota
• https://suse.com/security/cve/CVE-2020-10685 · Nota
• https://suse.com/security/cve/CVE-2020-1737 · Nota
• https://suse.com/security/cve/CVE-2018-18624 · Nota
• https://suse.com/security/cve/CVE-2019-14904 · Nota
• https://bugzilla.suse.com/1137479 · Nota
• https://suse.com/security/cve/CVE-2019-10156 · Nota
• https://bugzilla.suse.com/1177120 · Nota
• https://bugzilla.suse.com/1109957 · Nota