GitHub Advisoryadvisory · Maven

GHSA-prv5-c2px-j9q3 Apache StreamPark has a hard-coded encryption key

HIGH Published 2025-12-12 Modified 2025-12-12 Official page ↗
Aliases
CVE-2025-54947
Ecosystem
Maven
Packages
org.apache.streampark:streampark
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-321, CWE-798
Reviewed
2025-12-12

Affected packages

• Maven org.apache.streampark:streampark: >= 2.0.0, < 2.1.7 → fixed in 2.1.7

Description

In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists. This vulnerability occurs because the system uses a fixed, immutable key for encryption instead of dynamically generating or securely configuring the key. Attackers may obtain this key through reverse engineering or code analysis, potentially decrypting sensitive data or forging encrypted information, leading to information disclosure or unauthorized system access. This issue affects Apache StreamPark: from 2.0.0 before 2.1.7. Users are recommended to upgrade to version 2.1.7, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2025-54947 In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists. vulnerability

Weakness · CWE (2)

  • CWE-321 Use of Hard-coded Cryptographic Key weakness
  • CWE-798 Use of Hard-coded Credentials weakness

References