Threats tagged 'ghsa-g498-8632-6hwv'

The DefaultStateSerializer component in Apache Storm, used for persisting and restoring stateful bolt checkpoints with a Redis-backed state provider, improperly configures Kryo serialization to allow deserialization of untrusted data without class registration. This enables an attacker with write access to the state store keyspace to inject serialized objects that execute arbitrary code in the worker JVM during state restoration. The vulnerability requires Redis-backed state usage and write privileges to the state store, which is a data-plane privilege distinct from code execution rights. Apache Storm 3.1.0 addresses this by enforcing class registration in the serializer, but upgrading may require migration due to changes in checkpoint restoration behavior.