kylinGHSA-9fj5-jg6f-qg5r
Use of Hard-coded Credentials in Apache Kylin
High7.5CVE-2021-45458 · Published Jan 8, 2022 · updated Feb 16, 2024
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.kylin:kylin Maven | < 3.1.3 | 3.1.3 |
| >= 4.0.0, < 4.0.1 | 4.0.1 |
Details and references
Apache Kylin provides encryption classes PasswordPlaceholderConfigurer to help users encrypt their passwords. In the encryption algorithm used by this encryption class, the cipher is initialized with a hardcoded key and IV. If users use class PasswordPlaceholderConfigurer to encrypt their password and configure it into kylin's configuration file, there is a risk that the password may be decrypted. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.
More kylin advisories
All| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jan 82022 | Command Injection in Apache Kylin CVE-2021-45456Mediumfixed in 4.0.1 | Medium | 4.0.1 |
| Jan 82022 | Kylin can receive user input and load any class through Class.forName(...). CVE-2021-31522Mediumfixed in 3.1.3, 4.0.1 | Medium | 3.1.3, 4.0.1 |
| Jan 82022 | SQL Injection in Apache Kylin CVE-2021-36774Medium6.5fixed in 3.1.3 | Medium6.5 | 3.1.3 |
| Jan 82022 | Server-Side Request Forgery in Apache Kylin CVE-2021-27738Mediumfixed in 3.1.3 | Medium | 3.1.3 |
| Jan 82022 | In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin. CVE-2021-45457High7.5fixed in 3.1.3, 4.0.1 | High7.5 | 3.1.3, 4.0.1 |
| Feb 102022 | Authentication bypass in Apache Kylin CVE-2020-13937Medium5.3fixed in 3.1.1, 4.0.0-beta | Medium5.3 | 3.1.1, 4.0.0-beta |