[<prev] [day] [month] [year] [list]
Message-ID: <119d7762-677b-a516-4cd9-814f9a0bf24c@apache.org>
Date: Thu, 04 Dec 2025 02:14:56 +0000
From: Huajie Wang <benjobs@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-53960: Apache StreamPark: Use the user’s password as the secret key Vulnerability
Severity: moderate
Affected versions:
- Apache StreamPark 2.0.0 before 2.1.7
Description:
In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists. This vulnerability occurs because the system uses a fixed, immutable key for encryption instead of dynamically generating or securely configuring the key. Attackers may obtain this key through reverse engineering or code analysis, potentially decrypting sensitive data or forging encrypted information, leading to information disclosure or unauthorized system access.
This issue affects Apache StreamPark: from 2.0.0 before 2.1.7.
Users are recommended to upgrade to version 2.1.7, which fixes the issue.
Credit:
omkar parkhe <omkarparth@...il.com> (finder)
References:
https://streampark.apache.org
https://www.cve.org/CVERecord?id=CVE-2025-53960
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
