Deserialization of Untrusted Data in Apache Storm

2019-08-0119:17:53

Google

osv.dev

0.003 Low

EPSS

Percentile

69.0%

JSON

In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class.

CPENameOperatorVersion
org.apache.storm:storm-kafka-clienteq1.2.1
org.apache.storm:storm-kafkaeq1.2.0
org.apache.storm:storm-kafka-clienteq1.1.2
org.apache.storm:storm-kafka-clienteq1.1.3
org.apache.storm:storm-kafkaeq1.2.1
org.apache.storm:storm-kafkaeq1.1.3
org.apache.storm:storm-kafkaeq1.2.2
org.apache.storm:storm-kafka-clienteq1.2.0
org.apache.storm:storm-kafka-clienteq1.1.0
org.apache.storm:storm-kafka-clienteq1.2.2

Name	Operator	Version
org.apache.storm:storm-kafka-client	eq	1.2.1
org.apache.storm:storm-kafka	eq	1.2.0
org.apache.storm:storm-kafka-client	eq	1.1.2
org.apache.storm:storm-kafka-client	eq	1.1.3
org.apache.storm:storm-kafka	eq	1.2.1
org.apache.storm:storm-kafka	eq	1.1.3
org.apache.storm:storm-kafka	eq	1.2.2
org.apache.storm:storm-kafka-client	eq	1.2.0
org.apache.storm:storm-kafka-client	eq	1.1.0
org.apache.storm:storm-kafka-client	eq	1.2.2