title: Unsafe Pre-Authentication Deserialization In Workers
description: An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4
problem types: CWE-502 Deserialization of Untrusted Data
affected:
{
product: Apache Storm
vendor: Apache Software Foundation
versions:
lessThan: Apache Storm *, status: affected, version: v1.0.0, versionType: custom
changes: [at: v2.1.1, status: unaffected], lessThan: v1.2.4, status: affected, version: Apache Storm, versionType: custom
}
metrics:
other: [
content: {'other': 'high'}
type: unknown
]
workarounds: Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0
Apache Storm 2.1.x users should upgrade to version 2.1.1
Apache Storm 1.x users should upgrade to version 1.2.4