[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <8d3fb2d0-ddeb-63da-1f6a-4c430a4a407d@apache.org>
Date: Fri, 12 Dec 2025 14:57:25 +0000
From: Huajie Wang <benjobs@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-54947: Apache StreamPark: Use hard-coded key
vulnerability
Severity: important
Affected versions:
- Apache StreamPark 2.0.0 before 2.1.7
Description:
In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists. This vulnerability occurs because the system uses a fixed, immutable key for encryption instead of dynamically generating or securely configuring the key. Attackers may obtain this key through reverse engineering or code analysis, potentially decrypting sensitive data or forging encrypted information, leading to information disclosure or unauthorized system access.
This issue affects Apache StreamPark: from 2.0.0 before 2.1.7.
Users are recommended to upgrade to version 2.1.7, which fixes the issue.
Credit:
omkarparth@...il.com (finder)
References:
https://streampark.apache.org
https://www.cve.org/CVERecord?id=CVE-2025-54947
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
