GHSA-p8jx-x2vw-wm33

Code execution in org.apache.storm:storm-core

Source: GitHub Advisory Database (reviewed) High CVE-2018-1331

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.storm:storm-core	>= 1.2.0, < 1.2.2	1.2.2
Maven	org.apache.storm:storm-core	< 1.1.3	1.1.3

Details

As written in the advisory (Markdown source, shown as plain text).

In Apache Storm 0.10.0 through 0.10.2, 1.0.0 through 1.0.6, 1.1.0 through 1.1.2, and 1.2.0 through 1.2.1, an attacker with access to a secure storm cluster in some cases could execute arbitrary code as a different user.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-1331 advisory
https://github.com/advisories/GHSA-p8jx-x2vw-wm33 advisory
http://storm.apache.org/2018/06/04/storm113-released.html web
http://storm.apache.org/2018/06/04/storm122-released.html web
http://www.openwall.com/lists/oss-security/2018/07/10/4 web
http://www.securityfocus.com/bid/104732 web
http://www.securitytracker.com/id/1041273 web