PUBLISHED
2025-12-12 16:15
MODIFIED
2025-12-12 16:15
EPSS (Prob. Exploit)
0.26%
Top 82.1%
> DESCRIPTION
When encrypting sensitive data, weak encryption keys that are fixed or directly generated based on user passwords are used. Attackers can obtain these keys through methods such as reverse engineering, code leaks, or password guessing, thereby decrypting stored or transmitted encrypted data, leading to the leakage of sensitive information.
This issue affects Apache StreamPark: from 2.0.0 before 2.1.7.
Users are recommended to upgrade to version 2.1.7, which fixes the issue.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation - To fulfill the need for a cryptographic primitive, the product implements a cryptographic algorithm using a non-standard, unproven, or disallowed/non-compliant cryptographic implementation.
> GITHUB SECURITY ADVISORY
GHSA-3hg2-rh4r-8qf6
HIGH
Apache StreamPark: Use the user’s password as the secret key Vulnerability
AFFECTED PACKAGES:
MAVEN / org.apache.streampark:streampark
>= 2.0.0, < 2.1.7
Fixed in: 2.1.7
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache StreamPark: Uses the user’s password as the secret key
AFFECTED PACKAGES:
Unknown / Unknown
20 versions affected
ALIASES:
GHSA-3hg2-rh4r-8qf6
> HISTORIQUE DES MODIFICATIONS
Première apparition
12/12/2025 16:15
Source: NVD
📊
ENRICHISSEMENT
19/01/2026 17:38
CVEPROJECT
Champ modifié: CVE Project
📊
ENRICHISSEMENT
01/01/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation - To fulfill the need for a cryptographic primitive, the product implements a cryptographic algorithm using a non-standard, unpro...
Total des modifications: 2
Dernière mise à jour: 9 months ago