cn.howardliu:gear-es (>=1.0.0-release, <=1.0.1-release), com.digitalpebble.stormcrawler:storm-crawler-aws (>=0.9, <=0.10) +24 more potentially affected by CVE-2018-1331 via org.apache.storm:storm-core (0.10.0)

org.apache.storm:storm-core MAVEN version 0.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.storm:storm-core and may be impacted: - cn.howardliu:gear-es =1.0.0-release, =0.9, =0.9, =0.9, =0.9, =0.9, =0.9, =0.0.5, =0.0.5, =0.0.18, =0.0.1...

org.apache.storm:flux-core (0.10.0-beta1), org.apache.storm:flux-examples (0.10.0-beta1) +1 more potentially affected by CVE-2018-1331 via org.apache.storm:storm-core (0.10.0-beta1)

org.apache.storm:storm-core MAVEN version 0.10.0-beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.storm:storm-core and may be impacted: - org.apache.storm:flux-core 0.10.0-beta1 - org.apache.storm:flux-examples 0.10.0-beta1 -...

com.github.intel-hadoop:gearpump-experiments-storm_2.11 (>=0.3.4, <=0.4.1), com.github.ptgoetz:flux (0.1.0) +3 more potentially affected by CVE-2018-1331 via org.apache.storm:storm-core (0.9.3)

org.apache.storm:storm-core MAVEN version 0.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.storm:storm-core and may be impacted: - com.github.intel-hadoop:gearpump-experiments-storm2.11 =0.3.4, =0.1.3, =0.0.13, =0.0.14 Source cves:...

com.accelerate-experience:storm-metrics-statsd (>=1.0.0, <=1.0.1), com.accelerate-experience:storm-rabbitmq (1.0.0) +85 more potentially affected by CVE-2018-1331 via org.apache.storm:storm-core (>=1.0.0, <=1.1.2)

org.apache.storm:storm-core MAVEN version =1.0.0, =1.0.0, =0.1.0, =1.0, =1.0, =1.0, =1.3, =1.0, =1.0, =1.0, =1.0.0, =1.0.4 - com.github.ptgoetz:storm-jms 1.0.2 - com.github.ptgoetz:storm-signals 1.0.3 and more Source cves: CVE-2018-1331 Source advisory: OSV:GHSA-P8JX-X2VW-WM33...

org.apache.storm:flux-core (>=1.2.0, <=1.2.1), org.apache.storm:storm-elasticsearch-examples (>=1.2.0, <=1.2.1) +14 more potentially affected by CVE-2018-1331 via org.apache.storm:storm-core (>=1.2.0, <=1.2.1)

org.apache.storm:storm-core MAVEN version =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.1 and more Source cves: CVE-2018-1331 Source advisory: GHSA-P8JX-X2VW-WM33...

org.apache.storm:apache-storm-bin (0.10.2), org.apache.storm:apache-storm-source (0.10.2) +10 more potentially affected by CVE-2018-1331 via org.apache.storm:storm-core (0.10.2)

org.apache.storm:storm-core MAVEN version 0.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.storm:storm-core and may be impacted: - org.apache.storm:apache-storm-bin 0.10.2 - org.apache.storm:apache-storm-source 0.10.2 -...

com.accelerate-experience:storm-metrics-statsd (>=1.0.0, <=1.0.1), com.accelerate-experience:storm-rabbitmq (1.0.0) +85 more potentially affected by CVE-2018-1331 via org.apache.storm:storm-core (>=1.0.0, <=1.1.2)

org.apache.storm:storm-core MAVEN version =1.0.0, =1.0.0, =0.1.0, =1.0, =1.0, =1.0, =1.3, =1.0, =1.0, =1.0, =1.0.0, =1.0.4 - com.github.ptgoetz:storm-jms 1.0.2 - com.github.ptgoetz:storm-signals 1.0.3 and more Source cves: CVE-2018-1331 Source advisory: GHSA-P8JX-X2VW-WM33...

CVE-2018-1331

In Apache Storm 0.10.0 through 0.10.2, 1.0.0 through 1.0.6, 1.1.0 through 1.1.2, and 1.2.0 through 1.2.1, an attacker with access to a secure storm cluster in some cases could execute arbitrary code as a different user...

cn.howardliu:gear-es (>=1.0.0-release, <=1.0.1-release), com.accelerate-experience:storm-metrics-statsd (>=1.0.0, <=1.0.1) +97 more potentially affected by CVE-2018-1331 via org.apache.storm:storm-core (>=0.9.3, <=1.1.2)

org.apache.storm:storm-core MAVEN version =0.9.3, =1.0.0-release, =1.0.0, =0.1.0, =0.9, =0.9, =0.9, =1.3, =0.9, =0.9, =0.9, =1.0.0, =0.3.4, =0.4.1 and more Source cves: CVE-2018-1331 Source advisory: MEND:CVE-2018-1331...

CVE-2018-1331

The provided connected documents confirm CVE-2018-1331 affects Apache Storm versions: 0.10.0–0.10.2, 1.0.0–1.0.6, 1.1.0–1.1.2, and 1.2.0–1.2.1. The vulnerability allows an attacker with access to a secure Storm cluster to execute arbitrary code as a different user. The available sources describe ...

org.apache.storm:flux-core (>=1.2.0, <=1.2.1), org.apache.storm:storm-elasticsearch-examples (>=1.2.0, <=1.2.1) +14 more potentially affected by CVE-2018-1331 via org.apache.storm:storm-core (>=1.2.0, <=1.2.1)

org.apache.storm:storm-core MAVEN version =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.1 and more Source cves: CVE-2018-1331 Source advisory: MEND:CVE-2018-1331...