PT-2019-8799 · Apache · Apache Storm

Published 2019-07-25 · Updated 2020-11-12 · CVE-2018-11779

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Storm versions 1.1.0 through 1.2.2

Description The issue allows an attacker to cause the Storm UI daemon to deserialize user-provided bytes into a Java class when using the storm-kafka-client or storm-kafka modules.

Recommendations For Apache Storm versions 1.1.0 through 1.2.2, consider disabling the storm-kafka-client or storm-kafka modules until a patch is available to prevent the Storm UI daemon from deserializing user-provided bytes into a Java class. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2018-11779

GHSA-25PC-85QF-6J69

SUSE-SU-2020:2876-1

SUSE-SU-2020:3309-1

Affected Products

Apache Storm

References · 124

• https://osv.dev/vulnerability/SUSE-SU-2020:3309-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-11779 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:2876-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-11779 · Security Note
• https://osv.dev/vulnerability/GHSA-25pc-85qf-6j69 · Vendor Advisory
• https://suse.com/security/cve/CVE-2019-14864 · Note
• https://suse.com/security/cve/CVE-2020-1735 · Note
• https://t.me/cibsecurity/5724 · Telegram Post
• https://bugzilla.suse.com/1097775 · Note
• https://bugzilla.suse.com/1164133 · Note
• https://suse.com/security/cve/CVE-2018-16837 · Note
• https://suse.com/security/cve/CVE-2019-14905 · Note
• https://suse.com/security/cve/CVE-2020-10685 · Note
• https://suse.com/security/cve/CVE-2020-1737 · Note
• https://suse.com/security/cve/CVE-2018-18624 · Note