[GHSA-898j-5cc8-cmf5] Moderate severity vulnerability that affects org.apache.storm:storm-core #3838
Conversation
github-actions
bot
changed the base branch from
main
to
MarkLee131/advisory-improvement-3838
|
Hey @MarkLee131, not sure I follow on this one. Can you elaborate on how the commits resolve a zip slip and/or do you know of some linkage to the advisory? |
|
Hi, you can see the root cause of this CVE on the NVD or CVE website. and the commit msgs and code diff of these commits show their intention for fixing the zip-slip vuln for archive files in Meanwhile, Synk also detailed this vuln in its report (https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHESTORM-73624), and referred to one of our updated patch commit: apache/storm@1117a37. |
advisory-database
bot
merged commit a54cdb0
into
MarkLee131/advisory-improvement-3838
|
Hi @MarkLee131! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future! |
Updates
Comments
Add four patfches:
apache/storm@0fc6b52
apache/storm@efad4cc
apache/storm@1117a37
apache/storm@f61e5da
, of which the commit message claims
STORM-3052: Allow for blobs to be unzipped/untarred