Description
Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose a vulnerability that could allow a user to impersonate another user when communicating with some Storm Daemons.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Storm | Apache Storm 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.storm:storm-core | < 1.1.3 | 1.1.3 | GHSA-q35p-chc6-7x57 |
| Maven | org.apache.storm:storm-core | >= 1.2.0, < 1.2.2 | 1.2.2 | GHSA-q35p-chc6-7x57 |