CVE-2018-11779 Deserialization of Untrusted Data in Apache Storm

What is CVE-2018-11779?

CVE-2018-11779 is a critical unsafe deserialization vulnerability in Apache Storm, published on 25 Jul 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class.

Weakness: CWE-502

Which versions are affected by CVE-2018-11779?

4 open source packages ship an affected version, including org.apache.storm:storm-kafka and org.apache.storm:storm-kafka-client. It affects 1 product.

Products include Apache Storm.

How do I fix CVE-2018-11779?

Upgrade org.apache.storm:storm-kafka to 1.2.3 or later.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2018-11779 being exploited?

There is no known exploitation of CVE-2018-11779 in the wild and no public exploit code.

Other vulnerabilities in Apache Storm

• CVE-2021-38294 Shell Command Injection Vulnerability in Nimbus Thrift Server Critical 9.8
• CVE-2021-40865 Unsafe Pre-Authentication Deserialization In Workers Critical 9.8
• CVE-2015-3188 Apache Storm remote code execution vulnerability Critical 9.8
• CVE-2026-35337 Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling High 8.8
• CVE-2018-1331 Code execution in org.apache.storm:storm-core High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-25pc-85qf-6j69.