CVE-2017-9799
Apache Storm it is possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user
It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure credentials of the other user being compromised.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure credentials of the other user being compromised.
- Record
CVE-2017-9799- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure credentials of the other user being compromised.
- Record
CVE-2017-9799- Updated
- 2026-11-02
EUVDEUVD-2018-0712 No score
It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure credentials of the other user being compromised.
- Record
EUVD-2018-0712- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x825-rjww-2245
Apache Storm it is possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user
It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure credentials of the other user being compromised.
- Record
GHSA-x825-rjww-2245- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure credentials of the other user being compromised.
- Record
CVE-2017-9799- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-x825-rjww-2245
Apache Storm it is possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user
It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure credentials of the other user being compromised.
- Record
GHSA-x825-rjww-2245- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVSUSE-SU-2017:3000-1 No score
Security update for storm, storm-kit
This update for storm, storm-kit fixes the following issues:
- Update storm to version 1.0.5 (bsc#1059463, CVE-2017-9799)
- Update storm-kit to version 1.0.5 (bsc#1059463, CVE-2017-9799)
- Initial package (bsc#1048688, fate#323204)
- Record
SUSE-SU-2017:3000-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.storm:storm-coreMaven |
1.1.0 to 1.1.0 | 1.1.1 |
org.apache.storm:storm-coreMaven |
1.0.0 up to 1.0.4 | 1.0.4 |
org.apache.storm:storm-coreMaven |
1.1.0 up to 1.1.1 | 1.1.1 |
org.apache.storm:storm-coreMaven |
1.0.0 up to 1.0.4, plus listed versions 1.0.11.0.21.0.3 |
1.0.4 |
stormSUSE:OpenStack Cloud 7 |
before 1.0.5-5.3 | 1.0.5-5.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-9799 is a high vulnerability (CVSS 8.8) in Apache Storm, published August 9, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.87%, the 92nd percentile. Fixed in org.apache.storm:storm-core 1.1.1.
References
lists.apache.org/thread.html/b9125bf507ed6f2ca6e85ba1a4b44e232aa70eeddfba2a9d8a954127%40%3Cdev.storm.apache.org%3E
securityfocus.com/bid/100235
securitytracker.com/id/1039116
nvd.nist.gov/vuln/detail/CVE-2017-9799
github.com/advisories/GHSA-x825-rjww-2245