Deserialization of Untrusted Data in Apache Storm

Also known as GHSA-25pc-85qf-6j69

Published 7 y ago 2019-07-25 · modified 4 mo ago 2026-06-17 · JSON

CVSS

9.8

v3.0 · NVD

CISA KEV

not known exploited

EPSS

3.5%

percentile 89%

Public exploits

none known

In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class.

Exploit prediction (EPSS)

3.48% probability of exploitation in the next 30 days, higher than 89% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	9.8	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	7.5	`AV:N/AC:L/Au:N/C:P/I:P/A:P`
GitHub	3.0	9.8	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`org.apache.storm:storm-kafka`	>=1.1.0, <1.2.3	1.2.3
maven	`org.apache.storm:storm-kafka-client`	>=1.1.0, <1.2.3	1.2.3

Affected products

Apache Storm

Classification

Weakness

CWE-502 Deserialization of Untrusted Data

References

lists.apache.org /thread.html/3e4f704c4bd9296405a07a0290b8cbb6cbf5046e277efe6d93280a98%40%3Cuser.storm.apac · mailing-list, x_refsource_MLIST, x_transferred
nvd.nist.gov /vuln/detail/CVE-2018-11779 · advisory
lists.apache.org /thread.html/3e4f704c4bd9296405a07a0290b8cbb6cbf5046e277efe6d93280a98@%3Cuser.storm.apache · web

Sources

CVE List: CVE-2018-11779
GitHub Advisory: GHSA-25pc-85qf-6j69
NVD: CVE-2018-11779

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary