Apache Storm Worker Launcher vulnerabilities
2 known vulnerabilities in Apache Storm Worker Launcher from Apache. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
2vulnerabilities
0critical
2high
0exploited
7.8average CVSS score
Latest first
- 7.8 High severity
Apache Storm Worker Launcher: Time-of-check Time-of-use (TOCTOU) Race Condition
Description When launching a Docker or OCI worker, the setuid-root `worker-launcher` first changes ownership of the entire worker directory to the untrusted topology user, and only afterwards reads and acts on the command file that the supervisor wrote into th
- 7.8 High severity
Apache Storm Worker Launcher: Time-of-check Time-of-use (TOCTOU) Race Condition
Description The setuid-root `worker-launcher` binary adjusts ownership and permissions of worker directories by walking the tree with FTS and calling `lchown` and `chmod` on each entry's full pathname while running with an effective uid of 0. Both syscalls re-