CVE-2021-40865 Unsafe Pre-Authentication Deserialization In Workers

2021-10-2512:22:37

CWE-502

apache

www.cve.org

10 High

AI Score

Confidence

High

0.015 Low

EPSS

Percentile

86.8%

JSON

An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4

CNA Affected

[
  {
    "product": "Apache Storm",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "Apache Storm *",
        "status": "affected",
        "version": "v1.0.0",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "v2.1.1",
            "status": "unaffected"
          },
          {
            "at": "v2.2.1",
            "status": "unaffected"
          },
          {
            "at": "v2.3.0",
            "status": "unaffected"
          }
        ],
        "lessThan": "v1.2.4",
        "status": "affected",
        "version": "Apache Storm",
        "versionType": "custom"
      }
    ]
  }
]