This is an automated email from the ASF dual-hosted git repository.
rzo1 pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/storm-site.git
The following commit(s) were added to refs/heads/main by this push:
new 2ebcbbf276 Add release notes of 2.8.6 as blog post
2ebcbbf276 is described below
commit 2ebcbbf27680ef18c887d98a3df8544884af0df9
Author: Richard Zowalla <[email protected]>
AuthorDate: Sun Apr 12 20:19:32 2026 +0200
Add release notes of 2.8.6 as blog post
---
_posts/2026-04-12-storm286-released.md | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/_posts/2026-04-12-storm286-released.md
b/_posts/2026-04-12-storm286-released.md
index f37032e38d..bb9eb78847 100644
--- a/_posts/2026-04-12-storm286-released.md
+++ b/_posts/2026-04-12-storm286-released.md
@@ -27,13 +27,14 @@ users on the mailing lists. Your efforts are much
appreciated.
<p><strong>Versions Affected:</strong> before 2.8.6.</p>
<p><strong>Description:</strong> When processing topology credentials
submitted via the Nimbus Thrift API, Storm deserializes the base64-encoded TGT
blob using <code>ObjectInputStream.readObject()</code> without any class
filtering or validation. An authenticated user with topology submission rights
could supply a crafted serialized object in the <code>"TGT"</code> credential
field, leading to remote code execution in both the Nimbus and Worker JVMs.</p>
<p><strong>Mitigation:</strong> 2.x users should upgrade to 2.8.6.</p>
-<p>Users who cannot upgrade immediately should monkey-patch an
<code>ObjectInputFilter</code> allow-list to
<code>ClientAuthUtils.deserializeKerberosTicket()</code> restricting
deserialized classes to
<code>javax.security.auth.kerberos.KerberosTicket</code> and its known
dependencies.</p>
+<p>Users who cannot upgrade immediately should monkey-patch an
<code>ObjectInputFilter</code> allow-list to
<code>ClientAuthUtils.deserializeKerberosTicket()</code> restricting
deserialized classes to
<code>javax.security.auth.kerberos.KerberosTicket</code> and its known
dependencies; see <a
href="https://dist.apache.org/repos/dist/release/storm/apache-storm-2.8.6/RELEASE_NOTES.html";>for
details.</a></p>
<p><strong>Credit:</strong> This issue was discovered by K.</p>
<h3>CVE-2026-35565 - Stored Cross-Site Scripting (XSS) via Unsanitized
Topology Metadata in Storm UI</h3>
<p><strong>Versions Affected:</strong> before 2.8.6.</p>
<p><strong>Description:</strong> The Storm UI visualization component
interpolates topology metadata including component IDs, stream names, and
grouping values directly into HTML via <code>innerHTML</code> in
<code>parseNode()</code> and <code>parseEdge()</code> without sanitization at
any layer. An authenticated user with topology submission rights could craft a
topology containing malicious HTML/JavaScript in component identifiers,
resulting in stored cross-site scripting. In multi-ten [...]
<p><strong>Mitigation:</strong> 2.x users should upgrade to 2.8.6.</p>
+<p>Users wh ocannot upgrade immediately should monkey-patch the related
escaping; see <a
href="https://dist.apache.org/repos/dist/release/storm/apache-storm-2.8.6/RELEASE_NOTES.html";>for
details.</a></p>
<p><strong>Credit:</strong> This issue was discovered while investigating
another report by K.</p>
<h2>Enhancements</h2>
