Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2026/VULN429
_____________________________________________________________________

DATE                : 27/04/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache Storm versions
                                 prior to 2.8.7.

=====================================================================
https://lists.apache.org/thread/wov15mqsw6d9wzm1svnp37nt6zmp34z6
https://lists.apache.org/thread/f4f44z7ho5vcwjw6njwvt1z0onp8wbc5
_____________________________________________________________________

CVE-2026-40557: Apache Storm Prometheus Reporter: Disabling TLS
verification for Prometheus Reporter also disables it for all other
connections

Severity: moderate 

Affected versions:

- Apache Storm Prometheus Reporter
(org.apache.storm:storm-metrics-prometheus) 2.6.3 before 2.8.7

Description:

Improper Certificate Validation via Global SSL Context Downgrade in
Apache Storm Prometheus Reporter


Versions Affected: from 2.6.3 to 2.8.6


Description: 

In production deployments where an administrator enables
storm.daemon.metrics.reporter.plugin.prometheus.skip_tls_validation
(by default it is disabled) intending to affect only the Prometheus
reporter, the undocumented global side effect creates an attack
surface across every TLS-protected communication channel in the
Storm daemon.


The PrometheusPreparableReporter class implements an
INSECURE_TRUST_MANAGER that accepts all SSL certificates without
validation, with empty checkClientTrusted and checkServerTrusted
methods. Most critically, when the
storm.daemon.metrics.reporter.plugin.prometheus.skip_tls_validation
configuration option is enabled (default = disabled) for HTTPS
Prometheus PushGateway connections, the INSECURE_CONNECTION_FACTORY
calls SSLContext.setDefault(sslContext), which globally replaces
the JVM's default SSL context rather than applying the insecure
context only to the Prometheus connection. This payload flows
through storm.yaml configuration → PrometheusPreparableReporter.prepare() → INSECURE_CONNECTION_FACTORY → SSLContext.setDefault(),
resulting in a JVM-wide TLS security downgrade. All subsequent
HTTPS connections in the process - including ZooKeeper, Thrift,
Netty, and UI connections - silently trust all certificates,
including self-signed, expired, and attacker-generated ones,
enabling man-in-the-middle interception of cluster state,
topology submissions, tuple data, and administrative credentials.


Mitigation: 2.x users should upgrade to 2.8.7 if the Prometheus
Metrics Reporter is used. Prometheus Metrics Reporter Users who
cannot upgrade immediately should remove the
storm.daemon.metrics.reporter.plugin.prometheus.skip_tls_validation:
true setting from their storm.yaml configuration and instead
configure a proper truststore containing the PushGateway's
certificate.

Credit:

K (finder)

References:

https://storm.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-40557

_____________________________________________________________________


CVE-2026-41081: Apache Storm Client: Anonymous principal assigned on
TLS client certificate verification failure
Severity: moderate 

Affected versions:

- Apache Storm Client (org.apache.storm:storm-client) before 2.8.7

Description:

Improper Handling of TLS Client Authentication Failure Leading to
Anonymous Principal Assignment in Apache Storm

Versions Affected: up to 2.8.7

Description: When TLS transport is enabled in Apache Storm without
requiring client certificate authentication (the default
configuration), the TlsTransportPlugin assigns a fallback principal
(CN=ANONYMOUS) if no client certificate is presented or if
certificate verification fails. The underlying
SSLPeerUnverifiedException is caught and suppressed rather than
rejecting the connection.

This fail-open behavior means an unauthenticated client can establish
a TLS connection and receive a valid principal identity. If the
configured authorizer (e.g., SimpleACLAuthorizer) does not explicitly
deny access to CN=ANONYMOUS, this may result in unauthorized access
to Storm services. The condition is logged at debug level only,
reducing visibility in production.

Impact: Unauthenticated clients may be assigned a principal identity,
potentially bypassing authorization in permissive or misconfigured
environments.

Mitigation: Users should upgrade to 2.8.7 in which TLS authentication
failures are handled in a fail-closed manner.

Users who cannot upgrade immediately should:
- Enable mandatory client certificate authentication (nimbus.thrift.tls.client.auth.required: true)
- Ensure authorization rules explicitly deny access to CN=ANONYMOUS
- Review all ACL configurations for implicit default-allow behavior

Credit:

K (finder)

References:

https://storm.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-41081



=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================