CVE-2025-54947

In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists. This vulnerability occurs because the system uses a fixed, immutable key for encryption instead of dynamically generating or securely configuring the key. Attackers may obtain this key through reverse engineering or code analysis, potentially decrypting sensitive data or forging encrypted information, leading to information disclosure or unauthorized system access. This issue affects Apache StreamPark: from 2.0.0 before 2.1.7. Users are recommended to upgrade to version 2.1.7, which fixes the issue.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/kdntmzyzrco75x9q6mc6s8lty1fxmog1	Mailing List
http://www.openwall.com/lists/oss-security/2025/12/12/3	Mailing List

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:streampark:*:*:*:*:*:*:*:*

History

07 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) En las versiones 2.0.0 a 2.1.7 de Apache StreamPark, existe una vulnerabilidad de seguridad que implica una clave de cifrado codificada de forma rígida. Esta vulnerabilidad se produce porque el sistema utiliza una clave fija e inmutable para el cifrado en lugar de generar la clave dinámicamente o configurarla de forma segura. Los atacantes pueden obtener esta clave mediante ingeniería inversa o análisis de código, lo que podría permitir descifrar datos sensibles o falsificar información cifrada, lo que lleva a la revelación de información o al acceso no autorizado al sistema. Este problema afecta a Apache StreamPark: desde la versión 2.0.0 hasta antes de la 2.1.7. Se recomienda a los usuarios actualizar a la versión 2.1.7, que corrige el problema.

Information

Published : 2025-12-12 15:15

Updated : 2026-10-07 20:10

NVD link : CVE-2025-54947

Mitre link : CVE-2025-54947

CVE.ORG link : CVE-2025-54947

JSON object : View

Products Affected

apache

streampark

CWE

CWE-321

Use of Hard-coded Cryptographic Key

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2025-54947", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-54947", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-12T18:48:43.558729Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache StreamPark", "versions": [{"status": "affected", "version": "2.0.0", "lessThan": "2.1.7", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-12T15:15:53.577", "references": [{"url": "https://lists.apache.org/thread/kdntmzyzrco75x9q6mc6s8lty1fxmog1", "tags": ["Mailing List"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2025/12/12/3", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-321"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists. This vulnerability occurs because the system uses a fixed, immutable key for encryption instead of dynamically generating or securely configuring the key. Attackers may obtain this key through reverse engineering or code analysis, potentially decrypting sensitive data or forging encrypted information, leading to information disclosure or unauthorized system access.\n\nThis issue affects Apache StreamPark: from 2.0.0 before 2.1.7.\n\nUsers are recommended to upgrade to version 2.1.7, which fixes the issue."}, {"lang": "es", "value": "En las versiones 2.0.0 a 2.1.7 de Apache StreamPark, existe una vulnerabilidad de seguridad que implica una clave de cifrado codificada de forma r\u00edgida. Esta vulnerabilidad se produce porque el sistema utiliza una clave fija e inmutable para el cifrado en lugar de generar la clave din\u00e1micamente o configurarla de forma segura. Los atacantes pueden obtener esta clave mediante ingenier\u00eda inversa o an\u00e1lisis de c\u00f3digo, lo que podr\u00eda permitir descifrar datos sensibles o falsificar informaci\u00f3n cifrada, lo que lleva a la revelaci\u00f3n de informaci\u00f3n o al acceso no autorizado al sistema.\n\nEste problema afecta a Apache StreamPark: desde la versi\u00f3n 2.0.0 hasta antes de la 2.1.7.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 2.1.7, que corrige el problema."}], "lastModified": "2026-10-07T20:10:01.970", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:streampark:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "18BD3C9F-61F6-4D68-B0E7-333A94F827ED", "versionEndExcluding": "2.1.7", "versionStartIncluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}