CVE-2017-9799: High severity Apache storm vulnerability
It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure credentials of the other user being compromised.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-9799?
CVE-2017-9799 has been rated as a moderate severity vulnerability.
How do I fix CVE-2017-9799?
To mitigate CVE-2017-9799, upgrade Apache Storm to version 1.0.4 or 1.1.1 or later.
What versions of Apache Storm are affected by CVE-2017-9799?
CVE-2017-9799 affects Apache Storm versions 1.0.0 to 1.0.3 and 1.1.0.
What are the potential consequences of CVE-2017-9799?
Exploitation of CVE-2017-9799 may allow an attacker to run worker processes as a different user, potentially leading to credential exposure.
Who is at risk from CVE-2017-9799?
Operators using vulnerable versions of Apache Storm in misconfigured environments are at risk from CVE-2017-9799.