PT-2018-11743 · Apache · Apache Storm

Published 2018-06-05 · Updated 2018-10-17 · CVE-2018-1332

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Storm versions 1.0.6 and earlier Apache Storm versions 1.2.1 and earlier Apache Storm versions 1.1.2 and earlier

Description The issue allows a user to impersonate another user when communicating with some Storm Daemons.

Recommendations For Apache Storm versions 1.0.6 and earlier, update to a version later than 1.0.6 to resolve the issue. For Apache Storm versions 1.2.1 and earlier, update to a version later than 1.2.1 to resolve the issue. For Apache Storm versions 1.1.2 and earlier, update to a version later than 1.1.2 to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-1332

GHSA-Q35P-CHC6-7X57

Affected Products

Apache Storm

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2018-1332 · Security Note
• https://osv.dev/vulnerability/GHSA-q35p-chc6-7x57 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1332 · Vendor Advisory
• http://securityfocus.com/bid/104399 · Note
• https://github.com/advisories/GHSA-q35p-chc6-7x57 · Note
• https://lists.apache.org/thread.html/50f1d6a7af27f49d2e498a9ab2975685302cd8ca47000b7c38f339a4@%3Cdev.storm.apache.org%3E · Note
• https://lists.apache.org/thread.html/50f1d6a7af27f49d2e498a9ab2975685302cd8ca47000b7c38f339a4%40%3Cdev.storm.apache.org%3E · Note