{"id":"CVE-2017-9799","aliases":["EUVD-2018-0712","GHSA-x825-rjww-2245","SUSE-SU-2017:3000-1"],"status":"published","title":"Apache Storm it is possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user","description":"It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure credentials of the other user being compromised.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04872,"percentile":0.92109,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2017-08-09T21:00:00Z","modified":"2026-10-24T10:30:54Z","fixes":[{"ecosystem":"Maven","package":"org.apache.storm:storm-core","fixed_in":["1.1.1","1.0.4"],"sources":["ghsa","osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"storm","fixed_in":["1.0.5-5.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.storm:storm-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"last_affected":"1.1.0"},{"fixed":"1.1.1"}]}],"versions":["1.1.0"]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.storm:storm-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.storm:storm-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.1"}]}],"versions":["1.1.0"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.storm:storm-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"storm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.5-5.3"}]}]}],"products":[{"vendor":"apache","product":"storm"},{"vendor":"apache software foundation","product":"apache storm"}],"references":[{"url":"https://lists.apache.org/thread.html/b9125bf507ed6f2ca6e85ba1a4b44e232aa70eeddfba2a9d8a954127%40%3Cdev.storm.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/100235","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://www.securitytracker.com/id/1039116","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9799","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x825-rjww-2245","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/b9125bf507ed6f2ca6e85ba1a4b44e232aa70eeddfba2a9d8a954127@%3Cdev.storm.apache.org%3E","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20173000-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1048688","tags":["report"]},{"url":"https://bugzilla.suse.com/1059463","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9799","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-9799","description":"It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure credentials of the other user being compromised.","status":"published","published":"2017-08-09T21:00:00Z","modified":"2024-09-17T02:06:16.001Z","updated_at":"2026-11-02T14:33:13.606903Z"}],"euvd":[{"id":"EUVD-2018-0712","description":"It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure credentials of the other user being compromised.","status":"published","published":"2017-08-09T21:00:00Z","modified":"2024-09-17T02:06:16Z","updated_at":"2026-11-03T00:28:43.867146Z"}],"ghsa":[{"id":"GHSA-x825-rjww-2245","title":"Apache Storm it is possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user","description":"It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure credentials of the other user being compromised.","status":"published","published":"2018-10-17T18:30:01Z","modified":"2023-01-09T05:03:24Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:36:05.071174Z"}],"nvd":[{"id":"CVE-2017-9799","description":"It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure credentials of the other user being compromised.","status":"published","published":"2017-08-09T21:29:01.633Z","modified":"2026-06-17T01:28:56.69Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:03:57.282351Z"}],"osv":[{"id":"CVE-2017-9799","description":"It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure credentials of the other user being compromised.","status":"published","published":"2017-08-09T21:29:01.633Z","modified":"2026-10-24T10:30:54.607606758Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:07.192756Z"},{"id":"GHSA-x825-rjww-2245","title":"Apache Storm it is possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user","description":"It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure credentials of the other user being compromised.","status":"published","published":"2018-10-17T18:30:01Z","modified":"2024-12-02T05:50:16.004768Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:59.835583Z"},{"id":"SUSE-SU-2017:3000-1","title":"Security update for storm, storm-kit","description":"\nThis update for storm, storm-kit fixes the following issues:\n\n- Update storm to version 1.0.5 (bsc#1059463, CVE-2017-9799) \n- Update storm-kit to version 1.0.5 (bsc#1059463, CVE-2017-9799)\n- Initial package (bsc#1048688, fate#323204)","status":"published","published":"2017-11-13T10:44:20Z","modified":"2026-02-04T03:50:20.714241Z","updated_at":"2026-11-02T15:53:44.209561Z"}]}}