What is GHSA-w729-7633-2fw5?

GHSA-w729-7633-2fw5 is a security advisory published by GitHub Security Advisories with Critical severity. Deserialization of Untrusted Data leading to Remote Code Execution in Apache Storm

Which CVE IDs does GHSA-w729-7633-2fw5 cover?

GHSA-w729-7633-2fw5 covers the following CVE IDs: CVE-2021-40865. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-w729-7633-2fw5?

GHSA-w729-7633-2fw5 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-w729-7633-2fw5?

GHSA-w729-7633-2fw5 affects 3 products, including: maven/org.apache.storm:storm:\u003e= 2.2.0, \u003c 2.2.1; maven/org.apache.storm:storm:\u003e= 1.0.0, \u003c 1.2.4; maven/org.apache.storm:storm:\u003e= 2.1.0, \u003c 2.1.1.

GHSA-w729-7633-2fw5CriticalCVSS 9.8

Deserialization of Untrusted Data leading to Remote Code Execution in Apache Storm

Vendor

GitHub Security Advisories

Published

October 27, 2021

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2021-40865 →

📋 Description

An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4

🎯 Affected products3

maven/org.apache.storm:storm:>= 2.2.0, < 2.2.1
maven/org.apache.storm:storm:>= 1.0.0, < 1.2.4
maven/org.apache.storm:storm:>= 2.1.0, < 2.1.1

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2021-40865
https://lists.apache.org/thread.html/r8d45e74299897b6734dd0f788c46a631009ce2eeb731523386f7a253%40%3Cuser.storm.apache.org%3E
https://seclists.org/oss-sec/2021/q4/45
https://github.com/advisories/GHSA-w729-7633-2fw5