Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2025/VULN860
_____________________________________________________________________

DATE                : 16/12/2025

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache StreamPark versions prior
                                      to 2.1.7.

=====================================================================
https://lists.apache.org/thread/xlpvfzf5l5m5mfyjwrz5h4dssm3c32vy
https://lists.apache.org/thread/kdntmzyzrco75x9q6mc6s8lty1fxmog1
https://lists.apache.org/thread/9rbvdvwg5fdhzjdgyrholgso53r26998
_____________________________________________________________________

CVE-2025-53960: Apache StreamPark: Use the user’s password as the
secret key Vulnerability

Severity: moderate 

Affected versions:

- Apache StreamPark 2.0.0 before 2.1.7

Description:

In Apache StreamPark versions 2.0.0 through 2.1.7, a security
vulnerability involving a hard-coded encryption key exists. This
vulnerability occurs because the system uses a fixed, immutable key
for encryption instead of dynamically generating or securely
configuring the key. Attackers may obtain this key through reverse
engineering or code analysis, potentially decrypting sensitive data or
forging encrypted information, leading to information disclosure or
unauthorized system access.

This issue affects Apache StreamPark: from 2.0.0 before 2.1.7.

Users are recommended to upgrade to version 2.1.7, which fixes the
issue.

Credit:

omkar parkhe <om...@gmail.com> (finder)

References:

https://streampark.apache.org
https://www.cve.org/CVERecord?id=CVE-2025-53960

_____________________________________________________________________

CVE-2025-54947: Apache StreamPark: Use hard-coded key vulnerability
Severity: important 

Affected versions:

- Apache StreamPark 2.0.0 before 2.1.7

Description:

In Apache StreamPark versions 2.0.0 through 2.1.7, a security
vulnerability involving a hard-coded encryption key exists. This
vulnerability occurs because the system uses a fixed, immutable
key for encryption instead of dynamically generating or securely
configuring the key. Attackers may obtain this key through reverse
engineering or code analysis, potentially decrypting sensitive data
or forging encrypted information, leading to information disclosure
or unauthorized system access.

This issue affects Apache StreamPark: from 2.0.0 before 2.1.7.

Users are recommended to upgrade to version 2.1.7, which fixes
the issue.

Credit:

omkarparth@gmail.com (finder)

References:

https://streampark.apache.org
https://www.cve.org/CVERecord?id=CVE-2025-54947
_____________________________________________________________________

CVE-2025-54981: Apache StreamPark: Weak Encryption Algorithm in
StreamPark

Severity: important 

Affected versions:

- Apache StreamPark 2.0.0 before 2.1.7

Description:

Weak Encryption Algorithm in StreamPark, The use of an AES cipher in
ECB mode and a weak random number generator for encrypting sensitive
data, including JWT tokens, may have risked exposing sensitive
authentication data

This issue affects Apache StreamPark: from 2.0.0 before 2.1.7.

Users are recommended to upgrade to version 2.1.7, which fixes the
issue.

Credit:

omkar parkhe <om...@gmail.com> (finder)

References:

https://streampark.apache.org
https://www.cve.org/CVERecord?id=CVE-2025-54981



=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================