[<prev] [day] [month] [year] [list]
Message-ID: <29697e61-8a4b-6337-5ed2-f8b366885f05@apache.org>
Date: Wed, 26 Nov 2025 04:58:11 +0000
From: Karan Kumar <karan@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-59390: Apache Druid: Kerberos authenticaton chooses a
cryptographically unsecure secret if not configured explicitly.
Severity: low
Affected versions:
- Apache Druid through 34.0.0
Description:
Apache Druid’s Kerberos authenticator uses a weak fallback secret when the `druid.auth.authenticator.kerberos.cookieSignatureSecret` configuration is not explicitly set. In this case, the secret is generated using `ThreadLocalRandom`,
which is not a crypto-graphically secure random number generator. This
may allow an attacker to predict or brute force the secret used to sign
authentication cookies, potentially enabling token forgery or
authentication bypass. Additionally, each process generates its own
fallback secret, resulting in inconsistent secrets across nodes. This
causes authentication failures in distributed or multi-broker
deployments, effectively leading to a incorrectly configured clusters. Users are
advised to configure a strong `druid.auth.authenticator.kerberos.cookieSignatureSecret`
This issue affects Apache Druid: through 34.0.0.
Users are recommended to upgrade to version 35.0.0, which fixes the issue making it mandatory to set `druid.auth.authenticator.kerberos.cookieSignatureSecret` when using the Kerberos authenticator. Services will fail to come up if the secret is not set.
Credit:
Luke Smith (smithluke1966@...il.com) (finder)
1nfocalypse (analyst)
References:
https://druid.apache.org
https://www.cve.org/CVERecord?id=CVE-2025-59390
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
