CVE-2021-40865

An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4

Score

CVSS 3.1 9.8 Critical

Status

Modified - security@apache.org

Published

2021-10-25

Last modified

2024-08-04

Weaknesses

CWE-502

Affected products

• Storm (Apache)
• Apache Storm (Apache Software Foundation)

References

• https://lists.apache.org/thread.html/r8d45e74299897b6734dd0f788c46a631009ce2eeb731523386f7a253%40%3Cuser.storm.apache.o…
• https://seclists.org/oss-sec/2021/q4/45