The Apache Storm community is pleased to announce that version 3.2.0 has been released and is available from the downloads page.
This release adds a Prometheus reporter for the V2 topology metrics, pluggable tuple tracing with an OpenTelemetry tracer, and an opt-in virtual threads flag for the Thrift server handler pools on Java 25. It also resolves three security issues (see the Security Fixes below), adds a strict deserialization mode with a typed exception for tuples with unknown task or stream ids, and removes several long-deprecated APIs and settings (see the Upgrade Notes below). All users of earlier 3.x releases are strongly encouraged to upgrade. As with 3.0.0, Java 25 is required to run Apache Storm 3.x, and the Java API remains backwards-compatible with Storm 2.x, apart from the removals listed in the Upgrade Notes.
The Storm 2.x line has reached end of life and no longer receives security fixes. Users still on 2.x should treat the issues below as unpatched there and migrate to 3.x, where they are fixed in 3.2.0.
Two of the security fixes change behaviour that users may rely on (the Logviewer
no longer follows symbolic links, and DRPC and the UI deny a doAsUser request
that has no authenticated user); please read the mitigations below before
upgrading.
Special thanks are due to all those who have contributed to Apache Storm -- whether through direct code contributions, documentation, bug reports, security reports, or helping other users on the mailing lists. Your efforts are much appreciated.
Issues and pull requests addressed in the 3.2.0 release of Storm. Documentation for this release is available at the Apache Storm project site.
Versions Affected: 2.0.0 before 3.2.0.
Description: Nimbus returns the worker placement of every topology running on a supervisor, including the host, port, owner and resource assignment of topologies the caller is not authorized to read. In a multi-tenant cluster, an authenticated user who is allowed to access Nimbus can learn where the workers of other users' topologies run.
Mitigation: Upgrade to 3.2.0, where the supervisor page omits the workers of topologies the caller is not allowed to read. Admins and users with read access see the same page as before.
🏅 Credit: kta1kri, independent researcher, reported this issue.
Versions Affected: 3.0.0 before 3.2.0.
Description: When workers run as the topology owner, the Logviewer serves files that a worker has placed in its own log directory as links to other files. A user who is allowed to submit topologies can read the worker logs of other users' topologies, and other files the Logviewer process can read.
Mitigation: Upgrade to 3.2.0, where the Logviewer no longer follows symbolic links below the worker log root, and worker files must be direct children of a port directory (topologyId/port/file). Deeper paths, which the old download code still served, now answer 404.
🏅 Credit: Javier García Herrera reported this issue.
Versions Affected: 3.0.0 before 3.2.0.
Description: The DRPC HTTP endpoint lets an authenticated client act as another user without applying the configured impersonation authorizer. An authenticated user can execute DRPC functions that are restricted to another user.
Mitigation: Upgrade to 3.2.0, where DRPC checks the impersonation authorizer for these requests, and the host lists in nimbus.impersonation.acl apply to HTTP requests as well. A request with doAsUser but no authenticated user is now denied with 401 by DRPC and the UI. Behind a reverse proxy, host lists match the proxy's address; see docs/SECURITY.md.
🏅 Credit: Javier García Herrera reported this issue.
Pacemaker is now formally marked for removal. The Pacemaker classes in storm-client and storm-server (for example Pacemaker, PacemakerServer, PacemakerClient) and the constants Config.PACEMAKER_SERVERS, Config.PACEMAKER_PORT, Config.PACEMAKER_CLIENT_MAX_THREADS, Config.PACEMAKER_AUTH_METHOD, Config.PACEMAKER_THRIFT_MESSAGE_SIZE_MAX, DaemonConfig.PACEMAKER_MAX_THREADS and DaemonConfig.PACEMAKER_CHILDOPTS are now deprecated for removal (@Deprecated(forRemoval = true)). Behavior is unchanged. Code that references them gets compiler removal warnings. Plan to stop using Pacemaker before a future release removes it.
nimbus.supervisor.timeout.secs removed. The constant DaemonConfig.NIMBUS_SUPERVISOR_TIMEOUT_SECS ("nimbus.supervisor.timeout.secs"), deprecated since 3.1.0, and its entry in conf/defaults.yaml are gone. Nothing read this value: Nimbus detects a dead supervisor through its ephemeral ZooKeeper node. Remove the setting from storm.yaml, and change any code that references the constant.
storm.metrics.reporters: Deprecated in 2.3.0 and has now been removed. Topologies must configure worker metrics reporters using topology.metrics.reporters. Nimbus logs a warning if storm.metrics.reporters is still passed.blobstore.hdfs.principal and blobstore.hdfs.keytab: Deprecated in 2.2.0 and have now been removed.blobstore.hdfs.principal or blobstore.hdfs.keytab for HDFS Kerberos authentication must migrate their configuration to storm.hdfs.login.principal and storm.hdfs.login.keytab. Setting only the legacy blobstore.hdfs.* keys will log a warning and will no longer perform the Kerberos login.Config.TOPOLOGY_BACKPRESSURE_ENABLE removed. The public constant Config.TOPOLOGY_BACKPRESSURE_ENABLE ("topology.backpressure.enable"), marked for removal since 2.0.0, is gone. The key is now ignored, and Nimbus logs a warning when a submitted topology sets it. Worker backpressure is handled automatically, in-process.
Cluster state methods removed. IStormClusterState and StormClusterStateImpl no longer have backpressureTopologies, topologyBackpressure, setupBackpressure, removeBackpressure and removeWorkerBackpressure. Code that calls them must be changed.
<storm.zookeeper.root>/backpressure znodes. Nimbus no longer creates these znodes, and no longer removes them when it cleans up a topology, so leftovers from older versions stay in ZooKeeper. One exception: when storm.nimbus.zookeeper.acls.check or storm.nimbus.zookeeper.acls.fixup is true and ZooKeeper authentication is configured, Nimbus still deletes the entries of topologies that no longer exist under that path at startup. Otherwise operators can delete the subtree in zkCli with deleteall <storm.zookeeper.root>/backpressure (default /storm/backpressure).
BlowfishTupleSerializer removed. The class org.apache.storm.security.serialization.BlowfishTupleSerializer, deprecated since 2.8.6, is gone, along with its constant SECRET_KEY (topology.tuple.serializer.blowfish.key). Blowfish has a 64-bit block size that is vulnerable to birthday attacks (Sweet32). Topologies and code that register or reference it must stop doing so. To encrypt tuples between workers, use TLS transport encryption (storm.messaging.netty.tls.enable, see docs/SECURITY.md). Nimbus still masks topology.tuple.serializer.blowfish.key if an old stored config contains it.