Vulnerabilities

Description A topology's `topology.blobstore.map` lets the submitter choose a local name for each blob that the supervisor localises.

Description `getNimbusConf` returned the complete daemon configuration without redaction after only a user-level authorization check.

Description Nimbus validated `topology.blobstore.map` against the calling subject at submission time only.

Description When ZooKeeper authentication is configured, Storm deliberately retains `storm.zookeeper.topology.auth.payload` in the topology configuration, because workers need it.

Description Nimbus accepted the `uploadedJarLocation` argument of `submitTopology` / `submitTopologyWithOpts` as a server-side path and opened it directly, without checking that it referred to a file the caller had actua…

Description A submitted topology carries two lists of blobstore keys, `dependency_jars` and `dependency_artifacts`, which the client fills in after uploading the corresponding blobs.

Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topology_conf field of TopologyPageInfo.