CVE-2021-40865

Unsafe Pre-Authentication Deserialization In Workers

An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4

Affected

Apache Software Foundation · Apache Storm

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

64.18% chance of exploitation in the next 30 days, 99th percentile

Published

2021-10-25

Updated

2024-08-04

Proof-of-concept exploits (1)

• hktalent/CVE-2021-4086514★ · 2021-11-26

Security advisories

• https://lists.apache.org/thread.html/r8d45e74299897b6734dd0f788c46a631009ce2eeb731523386f…
• https://seclists.org/oss-sec/2021/q4/45
• advisories/GHSA-w729-7633-2fw5

References

• CVE Record
• NVD entry

Related

• CVE-2020-2546
• CVE-2020-2551
• CVE-2022-21306
• CVE-2022-21350
• CVE-2022-22963
• CVE-2022-23221