Threats tagged 'ghsa-j2q8-xx3q-8fqh'

Apache Storm versions prior to 2.8.7 improperly handle TLS client authentication failures by assigning a fallback anonymous principal (CN=ANONYMOUS) when client certificates are missing or fail verification. This fail-open behavior allows unauthenticated clients to establish TLS connections and potentially bypass authorization if access controls do not explicitly deny the anonymous principal. The issue is logged only at debug level, reducing detection likelihood in production environments. The vulnerability is fixed in version 2.8.7.