Description<\/p>\n
A submitted topology carries two lists of blobstore keys, `dependency_jars` and `dependency_artifacts`,
\nwhich the client fills in after uploading the corresponding blobs. Nimbus performed no validation of their
\ncontents on the submission path, yet acts on them in two places.<\/p>\n
During cleanup of a finished topology, Nimbus deletes the keys named in those lists, and the deletion is
\nperformed as the Nimbus subject, for which the blobstore short-circuits its ACL check. A submitter who
\nlisted a key belonging to another topology, such as its `-stormjar.jar`, could therefore cause
\nthat blob to be deleted when their own topology was cleaned up.<\/p>\n
Separately, on acquiring leadership a Nimbus compares the dependency keys of all active topologies against
\nthe blobstore contents and surrenders leadership if any is missing. A single key that does not exist, on a
\nsingle active topology, therefore causes every Nimbus to acquire leadership, surrender it and requeue
\nindefinitely, leaving the cluster without a leader and unable to schedule, clean up or accept submissions.<\/p>\n
Mitigation<\/p>\n
Upgrade to 3.1.0, where a submission is refused unless every entry in both lists is a dependency blob key
\nand exists in the blobstore.<\/p>\n
Note that this validates new submissions only; a topology stored by an affected version with an invalid list
\nis unaffected by the upgrade. An operator whose cluster is failing to retain a leader should inspect the
\nNimbus log for the dependency keys reported as missing and remove or resubmit the topology naming them.<\/p>\n
Users who cannot upgrade immediately should restrict topology submission to trusted principals.<\/p>\n
Credit<\/p>\n
This issue was discovered by rzo1 while investigating an unrelated blobstore defect.<\/p>\n","protected":false},"excerpt":{"rendered":"
Description<\/p>\n
A submitted topology carries two lists of blobstore keys, `dependency_jars` and `dependency_artifacts`,
\nwhich the client fills in after uploading the corresponding blobs. Nimbus performed<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-22281","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/22281","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=22281"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=22281"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=22281"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}