Vulnerability · Published Jan 6, 2022 · Assigned by apache
CVE-2021-45458Hardcoded credentials
High 7.5
In plain English
A high-severity hard-coded credentials in Apache Kylin from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Apache Kylin provides encryption classes PasswordPlaceholderConfigurer to help users encrypt their passwords. In the encryption algorithm used by this encryption class, the cipher is initialized with a hardcoded key and IV. If users use class PasswordPlaceholderConfigurer to encrypt their password and configure it into kylin's configuration file, there is a risk that the password may be decrypted. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.kylin:kylin | 3.1.3 | GHSA-9fj5-jg6f-qg5r |
| Maven | org.apache.kylin:kylin | 4.0.1 | GHSA-9fj5-jg6f-qg5r |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Kylin | Apache Kylin 2 – through 2.6.6Apache Kylin 3 – through 3.1.2Apache Kylin 4 – through 4.0.0 |
Weakness: CWE-798
References
- https://lists.apache.org/thread/oof215qz188k16vhlo97cm1jksxdowfy x_refsource_MISC
- [oss-security] 20220106 CVE-2021-45458: Apache Kylin: Hardcoded credentials mailing-list, x_refsource_MLIST
- [oss-security] 20220106 CVE-2021-45458: Apache Kylin: Hardcoded credentials mailing-list, x_refsource_MLIST