Description
It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure credentials of the other user being compromised.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Storm | 1.0.0 through 1.0.3, 1.1.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud 7 | storm | 1.0.5-5.3 | SUSE-SU-2017:3000-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.storm:storm-core | >= 1.1.0, < 1.1.1 | 1.1.1 | GHSA-x825-rjww-2245 |
| Maven | org.apache.storm:storm-core | >= 1.0.0, < 1.0.4 | 1.0.4 | GHSA-x825-rjww-2245 |
Advisories 1
- SUSE-SU-2017:3000-1 Security update for storm, storm-kit SUSE / openSUSE Security Updates · Feb 4, 2026
References
- [dev] 20170809 [CVE-2017-9799] Apache Storm Possible Code Execution As A Different User mailing-list
- 100235 vdb-entry
- 1039116 vdb-entry