Apache Storm Nimbus vulnerabilities
5 known vulnerabilities in Apache Storm Nimbus from Apache. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.1 High severity
Apache Storm Nimbus: Use of Externally-Controlled Input to Select Classes or Code
Description Nimbus instantiates the class named by a topology's `topology.scheduler.strategy` when scheduling it. The allowlist intended to constrain that choice, `nimbus.scheduler.strategy.class.whitelist`, was treated as "allow any class" when unset, and it
- 10.0 Critical severity
Apache Storm Nimbus: Insufficiently Protected Credentials
Description When ZooKeeper authentication is configured, Storm deliberately retains `storm.zookeeper.topology.auth.payload` in the topology configuration, because workers need it. Nimbus then served that configuration verbatim to any caller holding read-only t
- 8.1 High severity
Apache Storm Nimbus: Incorrect Authorization
Description Nimbus validated `topology.blobstore.map` against the calling subject at submission time only. The rebalance operation accepts configuration overrides and stripped a small set of keys from them, but never re-ran that validation, so a caller authori
- 7.8 High severity
Apache Storm Nimbus: Improper Limitation of a Pathname to a Restricted Directory
Description A topology's `topology.blobstore.map` lets the submitter choose a local name for each blob that the supervisor localises. That name was used to build a path under the topology's working directory without normalisation, in both `AsyncLocalizer` and
- 9.1 Critical severity
Description A submitted topology carries two lists of blobstore keys, `dependency_jars` and…
Description A submitted topology carries two lists of blobstore keys, `dependency_jars` and `dependency_artifacts`, which the client fills in after uploading the corresponding blobs. Nimbus performed no validation of their contents on the submission path, yet