CVE-2018-1332: Apache Storm Core - User Impersonation Vulnerability
Summary
CVE-2018-1332: Moderate severity vulnerability that affects org.apache.storm:storm-core. Affects org.apache.storm:storm-core across 2 version ranges.
< 1.1.3
>= 1.2.0, < 1.2.2
Fixed in 1.1.3 or 1.2.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Storm is a distributed real-time computation system designed to process large volumes of data. The storm-core package is a fundamental component of Apache Storm, providing core functionality and libraries for building Storm topologies. This vulnerability affects versions 1.0.6 and earlier, 1.2.1 and earlier, and 1.1.2 and earlier of the storm-core package.
Vulnerability Detail
The vulnerability in Apache Storm allows a user to impersonate another user when communicating with certain Storm Daemons. This can lead to unauthorized access and potential misuse of the system. The vulnerability arises from a lack of proper authentication and authorization checks in the affected versions of storm-core.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.1.31.1.3 -
>= 1.2.0, < 1.2.21.2.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed versions mentioned above to mitigate the risk of user impersonation.
Conclusion
The Apache Storm Core - User Impersonation Vulnerability (CVE-2018-1332) exposes a security flaw that allows user impersonation in certain Storm Daemons. It is crucial to upgrade to the fixed versions (1.1.3 or later for versions 1.0.6 and earlier, and 1.2.2 or later for versions 1.2.1 and earlier) to mitigate the risk of unauthorized access and misuse of the system. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.apache.storm:storm-core →
FAQ
Apache Storm is a distributed real-time computation system designed to process large volumes of data.
The storm-core package is a fundamental component of Apache Storm, providing core functionality and libraries for building Storm topologies.
Versions 1.0.6 and earlier, 1.2.1 and earlier, and 1.1.2 and earlier of the storm-core package are affected.
This vulnerability allows a user to impersonate another user when communicating with certain Storm Daemons, potentially leading to unauthorized access and misuse of the system.
To fix this vulnerability, upgrade to version 1.1.3 or later if using versions 1.0.6 and earlier, and upgrade to version 1.2.2 or later if using versions 1.2.1 and earlier.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.storm:storm-core.
