Threats tagged 'ghsa-p7mh-274j-m4mq'

Nimbus in Apache Storm instantiates a class specified by a topology's scheduler strategy configuration. The intended allowlist to restrict which classes can be instantiated was unset by default, effectively allowing any class on the Nimbus classpath with a no-argument constructor to be instantiated. This allows an authenticated submitter to cause Nimbus to instantiate classes with side effects, such as starting additional ZooKeeper servers or local clusters, leading to resource exhaustion in the Nimbus daemon. The issue is fixed in Apache Storm 3.1.0 by changing the default behavior to only allow built-in strategies when the allowlist is unset. Clusters using out-of-tree scheduler strategies must explicitly whitelist those classes or face rejection of the topologies.