Author: rzo1 Date: Sun Apr 12 18:10:28 2026 New Revision: 83757 Log: Add CVE details and mitigation
Modified: release/storm/apache-storm-2.8.6/RELEASE_NOTES.html release/storm/apache-storm-2.8.6/RELEASE_NOTES.html.asc release/storm/apache-storm-2.8.6/RELEASE_NOTES.html.sha512 Modified: release/storm/apache-storm-2.8.6/RELEASE_NOTES.html ============================================================================== --- release/storm/apache-storm-2.8.6/RELEASE_NOTES.html Sun Apr 12 17:36:51 2026 (r83756) +++ release/storm/apache-storm-2.8.6/RELEASE_NOTES.html Sun Apr 12 18:10:28 2026 (r83757) @@ -8,7 +8,84 @@ <h1>Release Notes for Apache Storm 2.8.6</h1> <p>Issues addressed in 2.8.6.</p> - <h2>dependencies</h2> + <h2>Security Fixes</h2> + <h3>CVE-2026-35337 - Deserialization of Untrusted Data vulnerability in Apache Storm</h3> + <p><strong>Versions Affected:</strong> before 2.8.6.</p> + <p><strong>Description:</strong> When processing topology credentials submitted via the Nimbus Thrift API, Storm deserializes the base64-encoded TGT blob using <code>ObjectInputStream.readObject()</code> without any class filtering or validation. An authenticated user with topology submission rights could supply a crafted serialized object in the <code>"TGT"</code> credential field, leading to remote code execution in both the Nimbus and Worker JVMs.</p> + <p><strong>Mitigation:</strong> 2.x users should upgrade to 2.8.6.</p> + <p>Users who cannot upgrade immediately should monkey-patch an <code>ObjectInputFilter</code> allow-list to <code>ClientAuthUtils.deserializeKerberosTicket()</code> restricting deserialized classes to <code>javax.security.auth.kerberos.KerberosTicket</code> and its known dependencies.</p> + <p>If you are unable to update, monkey-patching can be done by replacing the affected class in the Storm client JAR with the changes from <a href="https://github.com/apache/storm/commit/7c439567639a06b01b41da4005602e2e9f47383b";>this commit</a>, either by:</p> + <ul> + <li>Taking the <code>.class</code> file from the 2.8.6 Storm release (no breaking changes in this class) and replacing it in the existing JAR: + <ol> + <li>Extract the class from the 2.8.6 JAR:<br><code>jar xf storm-client-2.8.6.jar org/apache/storm/security/auth/ClientAuthUtils.class</code></li> + <li>Replace it in your existing JAR:<br><code>jar uf storm-client-2.8.5.jar org/apache/storm/security/auth/ClientAuthUtils.class</code></li> + </ol> + Note: check for inner classes first and extract/replace those too if present:<br> + <code>jar tf storm-client-2.8.6.jar | grep ClientAuthUtils</code> + </li> + <li>Checking out the 2.8.5 tag, applying the change, and building from source.</li> + </ul> + <p><strong>Credit:</strong> This issue was discovered by K.</p> + + <h3>CVE-2026-35565 -Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Storm UI</h3> + <p><strong>Versions Affected:</strong> before 2.8.6.</p> + <p><strong>Description:</strong> The Storm UI visualization component interpolates topology metadata including component IDs, stream names, and grouping values directly into HTML via <code>innerHTML</code> in <code>parseNode()</code> and <code>parseEdge()</code> without sanitization at any layer. An authenticated user with topology submission rights could craft a topology containing malicious HTML/JavaScript in component identifiers (e.g., a bolt ID containing an <code>onerror</code> event handler). This payload flows through Nimbus → Thrift → the Visualization API → vis.js tooltip rendering, resulting in stored cross-site scripting.</p> + <p>In multi-tenant deployments where topology submission is available to less-trusted users but the UI is accessed by operators or administrators, this enables privilege escalation through script execution in an admin's browser session.</p> + <p><strong>Mitigation:</strong> 2.x users should upgrade to 2.8.6.</p> + <p>Users who cannot upgrade immediately should monkey-patch <code>storm-webapp/src/main/webapp/js/visualization.js</code> as follows.</p> + <p><strong>Step 1.</strong> Add the following helper function after the existing <code>tooltipElement()</code> function:</p> +<pre><code>function escapeHtml(str) { + return String(str) + .replace(/&/g, "&amp;") + .replace(/</g, "&lt;") + .replace(/>/g, "&gt;") + .replace(/"/g, "&quot;") + .replace(/'/g, "&#039;"); +}</code></pre> + <p><strong>Step 2.</strong> In <code>parseNode()</code>, replace the <code>title</code> construction and <code>label</code> in the node object:</p> +<pre><code>var safeNodeId = escapeHtml(nodeId); +var safeCapacity = escapeHtml(nodeJson[":capacity"]); +var safeLatency = escapeHtml(nodeJson[":latency"]); + +var title = tooltipElement([ + { text: safeNodeId, bold: true }, + { text: "Capacity: " + safeCapacity }, + { text: "Latency: " + safeLatency } +]) + +var node = { + "id": nodeId, // keep raw — vis.js uses this as an internal key + "label": safeNodeId, + ...</code></pre> + <p><strong>Step 3.</strong> In <code>parseEdge()</code>, replace the <code>visNS.edges.update()</code> call:</p> +<pre><code>visNS.edges.update({ + "id": id, + "from": edgeJson[":component"], // keep raw — vis.js node reference key + "to": sourceId, // keep raw — vis.js node reference key + "label": escapeHtml(edgeJson[":stream"]), + "title": tooltipElement([ + { text: "From: " + escapeHtml(edgeJson[":component"]) }, + { text: "To: " + escapeHtml(sourceId) }, + { text: "Grouping: " + escapeHtml(edgeJson[":grouping"]) } + ]) +});</code></pre> + + <p>To deploy the patched file, replace it inside <code>storm-webapp-2.8.5.jar</code>, found in the <code>lib-webapp</code> directory of your Storm installation. Storm runs embedded Jetty and serves static resources directly from this JAR:</p> +<pre><code># Check the exact internal path first +jar tf lib-webapp/storm-webapp-2.8.5.jar | grep visualization.js + +# Recreate the directory structure to match (e.g. public/js/) +mkdir -p public/js +cp visualization.js public/js/visualization.js + +# Replace in the JAR +jar uf lib-webapp/storm-webapp-2.8.5.jar public/js/visualization.js</code></pre> + <p>Restart the Storm UI process after replacing the file.</p> + <p>As a defense-in-depth measure, restrict topology submission to trusted users via Nimbus ACLs.</p> + <p><strong>Credit:</strong> This issue was discovered while investigating another report by K.</p> + + <h2>Dependencies</h2> <ul><li>[<a href="https://github.com/apache/storm/pull/8502";>#8502</a>] - Bump com.google.errorprone:error_prone_annotations from 2.48.0 to 2.49.0</li> <li>[<a href="https://github.com/apache/storm/pull/8501";>#8501</a>] - Bump redis.clients:jedis from 7.4.0 to 7.4.1</li> <li>[<a href="https://github.com/apache/storm/pull/8500";>#8500</a>] - Bump cytoscape from 3.33.1 to 3.33.2 in /storm-webapp</li> @@ -48,13 +125,13 @@ <li>[<a href="https://github.com/apache/storm/pull/8436";>#8436</a>] - Bump picomatch from 4.0.3 to 4.0.4 in /storm-webapp</li> </ul> - <h2>enhancement</h2> + <h2>Enhancement</h2> <ul><li>[<a href="https://github.com/apache/storm/pull/8483";>#8483</a>] - Migrate to Java 24+ compatible security APIs and add Java 25 to CI </li> <li>[<a href="https://github.com/apache/storm/pull/8452";>#8452</a>] - Passing Conf object to KryoDecorator</li> <li>[<a href="https://github.com/apache/storm/issues/8305";>#8305</a>] - Improve dev-tools/release_notes.py to deal with multiple tags in an issue</li> </ul> - <h2>bug</h2> + <h2>Bug</h2> <ul><li>[<a href="https://github.com/apache/storm/issues/8456";>#8456</a>] - Storm 2.8.5 GUI using scientific notation in columns for large numbers</li> <li>[<a href="https://github.com/apache/storm/pull/8442";>#8442</a>] - Fix NPE in getSupervisorPageInfo for unknown hostnames</li> <li>[<a href="https://github.com/apache/storm/pull/8441";>#8441</a>] - Fix NPE in mkAssignments when assignment is deleted during scheduling</li> Modified: release/storm/apache-storm-2.8.6/RELEASE_NOTES.html.asc ============================================================================== --- release/storm/apache-storm-2.8.6/RELEASE_NOTES.html.asc Sun Apr 12 17:36:51 2026 (r83756) +++ release/storm/apache-storm-2.8.6/RELEASE_NOTES.html.asc Sun Apr 12 18:10:28 2026 (r83757) @@ -1,16 +1,17 @@ -----BEGIN PGP SIGNATURE----- -iQIzBAABCgAdFiEEM587L3ISmryoHZbakep5VqLa2c4FAmnVS9MACgkQkep5VqLa -2c7GYhAAn5ky1CoZcGz1puDTqGpFXdNxiARVviwr+Nyuxn92zONyX+ttIFlqPNYF -AYjVR9/NoQq8FZAJke84m/LjL1amMrqzAYk0PP60wxEtRPSS++rBewn5i5F/lxx+ -Pjlb+o/9dY40h6CkS2wTfz6eQnX8ttg2ddtvZo9JQR5kIX2xH+vW7/x0MnscfqMj -6Wi36eJkOXDSD5IEyAq55IQSyYviTs1EOXTwJVuxj4B3uBpuNUXBa9UrKxbbci2T -Hsppqp/Ztk8ON3yhJ33PE1wt71IQMaSeZp3nHa6dZyXBKjAE1UbpwiqufoyWxVFG -OKmWzAjrhtQjOgznKkqnm0MfgpAVThH4bhFwJtmZnlE9q6G1YTrn55tHJcwxCwx0 -QySc+LC0xDwU/aRwkmBhW9/EIi0vLuhSNlaPpjcOZfCO1wqMF0QWryfFNvnfsJ5R -NHYzlyHWHIUDgAqaet6r8aUfH3DR2RwPR9Gpgn+jQxTGYfkLLeVAboYRN8bs8nLT -l0AGu1SOirmYI9xHPPlnUaDRQjKP7N6goVSquRctD9XQdo/sv3BopnK1E1+ypvTC -MX+i9vTrsQ9UCWrgZ0JPlc7aDszIWQG94F7QLMa+HFR8kn0lDl8ep2g+9Z0U3rAY -vy9O5SIi3Tts2MW0NvBIjyogtwc9vMp4SaPC2g7UpBiSYbmhCEE= -=oZGc +iQJPBAABCAA5FiEEM587L3ISmryoHZbakep5VqLa2c4FAmnb3/cbFIAAAAAABAAO +bWFudTIsMi41KzEuMTIsMCwzAAoJEJHqeVai2tnOyjkP/0RdGb/ebBwtEgjAZC25 +CrknZtcprHDbm/26l/krMu7oW7dDa9NTmEEvvOhn5wP86qFwYmUpo6PvmeL38atx +k05fsoUFb36SseunztnwpQgDCtQnD+NM/bbHbgYV5inZmaNas0Ojxg18ZM7DcrKo +cRa/CBc6ObPq5Btwa7zlj2vhBe3+bfzYNUPtqXHsyMZ98FQbCfiWiiGwyYqJ3HDY +aAVa4vfcTVCyL9Sq4VdWeACdqO/GyfEMKZFcBoLRzeAcCqZUKtbhCoZAjo7paHMc +0zrASxbjs70JuLfjJf8UCI+kWYWURuT7mYTgJd6XOrdqn0xFNGuqTd7CgPso5tQy +dLBLZOuitbH35di76ZTdnoGS4NffFhPyi264Cvvf9UfkFsm2BFNlsDdS/BgmEaNF +TSQT31W3xfgfEZke9PdXMK2XhzzE0rqVz+kLjNUoMrT3i2sAikP+XgZM+Or/FAoK +Sb8dDmQVapvlXk+DV8gFEXqq992FQZzznNbyY1KYvcZGMqcSR6k4suu0lcvBGPnl +URef9IQ00+Wg2CA6k90k6L+mHBq7kGjJre9gUb8gKS0jpuI70T2sLB2QwGP2iBWw +MVHHEk0doaI6nhFnj2LHOhxl5SBT1vy4cc3DXQOVTEvBQYlZE5P4vcCUMixnAVes +VxfTyreK+tXXJp156JpRFK8m +=/FUi -----END PGP SIGNATURE----- Modified: release/storm/apache-storm-2.8.6/RELEASE_NOTES.html.sha512 ============================================================================== --- release/storm/apache-storm-2.8.6/RELEASE_NOTES.html.sha512 Sun Apr 12 17:36:51 2026 (r83756) +++ release/storm/apache-storm-2.8.6/RELEASE_NOTES.html.sha512 Sun Apr 12 18:10:28 2026 (r83757) @@ -1 +1 @@ -90114727245655f442f5b4b4343157c304cb93af01e6935076bccf78f842de7aed6d156584e56b61f6ba41f9a848a963d304f19c523e9294295162ee2c5a958a RELEASE_NOTES.html +3d14fd39b41008cba3c5e14d688c3f15be1a6169ae1e18257f61e6ff3d4c73c1c4a25ed1455141b33f40a61f82222c7570b776248cc38457bd2f9a7ef0f559fa RELEASE_NOTES.html
