CVE-2021-45458: Use of Hard-coded Credentials in Apache Kylin
Summary
CVE-2021-45458: Use of Hard-coded Credentials in Apache Kylin. Affects org.apache.kylin:kylin across 2 version ranges.
< 3.1.3
>= 4.0.0, < 4.0.1
Fixed in 3.1.3 or 4.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Kylin is an open-source distributed analytics engine designed to provide a SQL interface and multi-dimensional analysis (OLAP) on big data for data warehousing. It offers encryption classes, such as PasswordPlaceholderConfigurer, to help users encrypt their passwords. However, a vulnerability exists in the encryption algorithm used by this class, where the cipher is initialized with a hardcoded key and IV. This flaw affects Apache Kylin versions 2.6.6 and prior, 3.1.2 and prior, and 4.0.0 and prior.
Vulnerability Detail
The use of hardcoded credentials in Apache Kylin's encryption classes poses a security risk. If users encrypt their passwords using the PasswordPlaceholderConfigurer class and configure them in Kylin's configuration file, there is a possibility that the passwords may be decrypted. This vulnerability can potentially lead to unauthorized access to sensitive information and compromise the security of the system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.1.33.1.3 -
>= 4.0.0, < 4.0.14.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the latest version of Apache Kylin.
Conclusion
The use of hardcoded credentials in Apache Kylin's encryption classes poses a significant security risk. It is crucial for users to upgrade to the fixed versions of Apache Kylin to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.kylin:kylin →
FAQ
Apache Kylin is an open-source distributed analytics engine designed for big data analysis and data warehousing. It provides a SQL interface and multi-dimensional analysis capabilities.
This vulnerability can potentially lead to unauthorized access to sensitive information stored in Apache Kylin, compromising the security of the system.
Apache Kylin versions 2.6.6 and prior, 3.1.2 and prior, and 4.0.0 and prior are affected by this vulnerability.
To fix this vulnerability, users should upgrade to the fixed versions of Apache Kylin. For versions 2.x, upgrade to version 2.6.7 or later. For versions 3.x, upgrade to version 3.1.3 or later. For versions 4.x, upgrade to version 4.0.1 or later.
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the latest version of Apache Kylin.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.kylin:kylin.
