Security Advisory

CVE-2017-9799

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2017-08-09 21:00:00

Last updated 2024-09-17 02:06:16

Assigner apache

CVSS score not scored

State PUBLISHED

Description

It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure credentials of the other user being compromised.

← Browse all CVEs View on cve.org ↗