CVE-2017-9799: Apache Storm - Tricking Supervisor to Launch Worker as Different User
Summary
CVE-2017-9799: It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a... Affects org.apache.storm:storm-core across 2 version ranges.
>= 1.0.0, < 1.0.4
>= 1.1.0, < 1.1.1
Fixed in 1.0.4 or 1.1.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Storm is an open-source distributed real-time computation system. It provides a framework for processing streaming data in a fault-tolerant and scalable manner. The storm-core package is a key component of Apache Storm, responsible for managing and executing topologies. This vulnerability affects versions 1.0.0 to 1.0.4 and 1.1.0 to 1.1.1 of the storm-core package.
Vulnerability Detail
The vulnerability in Apache Storm allows the owner of a topology to deceive the supervisor into launching a worker as a different user. This can occur under specific situations and configurations. In the worst-case scenario, this could lead to the compromise of secure credentials belonging to the targeted user. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 1.0.41.0.4 -
>= 1.1.0, < 1.1.11.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched versions of Apache Storm.
Conclusion
The Apache Storm vulnerability (CVE-2017-9799) allows the owner of a topology to trick the supervisor into launching a worker as a different user. This can potentially lead to the compromise of secure credentials. It is crucial to upgrade to Apache Storm version 1.0.4 or 1.1.1 to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.apache.storm:storm-core →
FAQ
Apache Storm is an open-source distributed real-time computation system used for processing streaming data.
The storm-core package is a key component of Apache Storm responsible for managing and executing topologies.
Under specific situations and configurations, the owner of a topology can deceive the supervisor into launching a worker as a different user.
The compromise of secure credentials belonging to the targeted user is the worst-case scenario.
This vulnerability has a CVSS score of 8.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.storm:storm-core.
