Apache StreamPark Hard-Coded Encryption Key Vulnerability

A vulnerability exists in Apache StreamPark versions 2.0.0 prior to 2.1.7, where a fixed encryption key is used, either hard-coded or directly generated from user passwords. This flaw allows attackers to retrieve the keys through reverse engineering, code leaks, or password guessing, enabling them to decrypt sensitive data or forge encrypted information. The result is unauthorized access to sensitive information or systems.

Impact

Exploitation of this vulnerability could lead to unauthorized decryption of sensitive data, allowing for information disclosure or unauthorized access to systems.

Remediation

Users are advised to upgrade to Apache StreamPark version 2.1.7, which addresses this vulnerability.