deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-vc89-hccf-rq55
Package: org.typelevel:jawn-parser_2.12 (MAVEN)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-326: Inadequate Encryption Strength, CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 1.3.2
Patched in: 1.3.2

Summary: Hash collision in typelevel jawn

Details:
### Impact

Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack.  Most applications do not implement these traits directly, but inherit from a library:

Affected implementations include:
* `org.http4s` :: `http4s-play-json`
* `org.typelevel :: jawn-ast` (< 0.8.0)
* `org.typelevel :: jawn-play` (discontinued)
* `org.typelevel :: jawn-rojoma` (discontinued)
* `org.typelevel :: jawn-spray` (discontinued)

Unaffected implementations include:
* `io.argonaut :: argonaut-jawn`
* `io.circe :: circe-parser`
* `org.typelevel :: jawn-ast` (>= 0.8.0)
* `org.typelevel :: jawn-json4s` (discontinued)
* `org.typelevel :: jawn-argonaut` (discontinued)

### Patches

`jawn-parser-1.3.2` fixes the issue.

### Workarounds

Override `objectContext()` to use a collision-safe collection.  See [the patch](https://github.com/typelevel/jawn/pull/390/files) for an example in both `SimpleFacade` and `MutableFacade`.

### References

* https://github.com/typelevel/jawn/pull/390

### Credits

* @kag0, for the report and the patch

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [typelevel/jawn](https://github.com/typelevel/jawn)
* E-mail a maintainer:
  * [@rossabaker](mailto:ross@rossabaker.com)
GitHub Security Advisory: GHSA-vc89-hccf-rq55
Package: org.typelevel:jawn-parser_2.11 (MAVEN)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-326: Inadequate Encryption Strength, CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 1.3.2
Patched in: unpatched

Summary: Hash collision in typelevel jawn

Details:
### Impact

Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack.  Most applications do not implement these traits directly, but inherit from a library:

Affected implementations include:
* `org.http4s` :: `http4s-play-json`
* `org.typelevel :: jawn-ast` (< 0.8.0)
* `org.typelevel :: jawn-play` (discontinued)
* `org.typelevel :: jawn-rojoma` (discontinued)
* `org.typelevel :: jawn-spray` (discontinued)

Unaffected implementations include:
* `io.argonaut :: argonaut-jawn`
* `io.circe :: circe-parser`
* `org.typelevel :: jawn-ast` (>= 0.8.0)
* `org.typelevel :: jawn-json4s` (discontinued)
* `org.typelevel :: jawn-argonaut` (discontinued)

### Patches

`jawn-parser-1.3.2` fixes the issue.

### Workarounds

Override `objectContext()` to use a collision-safe collection.  See [the patch](https://github.com/typelevel/jawn/pull/390/files) for an example in both `SimpleFacade` and `MutableFacade`.

### References

* https://github.com/typelevel/jawn/pull/390

### Credits

* @kag0, for the report and the patch

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [typelevel/jawn](https://github.com/typelevel/jawn)
* E-mail a maintainer:
  * [@rossabaker](mailto:ross@rossabaker.com)
GitHub Security Advisory: GHSA-vc89-hccf-rq55
Package: org.typelevel:jawn-parser_2.10 (MAVEN)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-326: Inadequate Encryption Strength, CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 1.3.2
Patched in: unpatched

Summary: Hash collision in typelevel jawn

Details:
### Impact

Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack.  Most applications do not implement these traits directly, but inherit from a library:

Affected implementations include:
* `org.http4s` :: `http4s-play-json`
* `org.typelevel :: jawn-ast` (< 0.8.0)
* `org.typelevel :: jawn-play` (discontinued)
* `org.typelevel :: jawn-rojoma` (discontinued)
* `org.typelevel :: jawn-spray` (discontinued)

Unaffected implementations include:
* `io.argonaut :: argonaut-jawn`
* `io.circe :: circe-parser`
* `org.typelevel :: jawn-ast` (>= 0.8.0)
* `org.typelevel :: jawn-json4s` (discontinued)
* `org.typelevel :: jawn-argonaut` (discontinued)

### Patches

`jawn-parser-1.3.2` fixes the issue.

### Workarounds

Override `objectContext()` to use a collision-safe collection.  See [the patch](https://github.com/typelevel/jawn/pull/390/files) for an example in both `SimpleFacade` and `MutableFacade`.

### References

* https://github.com/typelevel/jawn/pull/390

### Credits

* @kag0, for the report and the patch

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [typelevel/jawn](https://github.com/typelevel/jawn)
* E-mail a maintainer:
  * [@rossabaker](mailto:ross@rossabaker.com)
GitHub Security Advisory: GHSA-vc89-hccf-rq55
Package: org.typelevel:jawn-parser_0.27 (MAVEN)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-326: Inadequate Encryption Strength, CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 1.3.2
Patched in: unpatched

Summary: Hash collision in typelevel jawn

Details:
### Impact

Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack.  Most applications do not implement these traits directly, but inherit from a library:

Affected implementations include:
* `org.http4s` :: `http4s-play-json`
* `org.typelevel :: jawn-ast` (< 0.8.0)
* `org.typelevel :: jawn-play` (discontinued)
* `org.typelevel :: jawn-rojoma` (discontinued)
* `org.typelevel :: jawn-spray` (discontinued)

Unaffected implementations include:
* `io.argonaut :: argonaut-jawn`
* `io.circe :: circe-parser`
* `org.typelevel :: jawn-ast` (>= 0.8.0)
* `org.typelevel :: jawn-json4s` (discontinued)
* `org.typelevel :: jawn-argonaut` (discontinued)

### Patches

`jawn-parser-1.3.2` fixes the issue.

### Workarounds

Override `objectContext()` to use a collision-safe collection.  See [the patch](https://github.com/typelevel/jawn/pull/390/files) for an example in both `SimpleFacade` and `MutableFacade`.

### References

* https://github.com/typelevel/jawn/pull/390

### Credits

* @kag0, for the report and the patch

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [typelevel/jawn](https://github.com/typelevel/jawn)
* E-mail a maintainer:
  * [@rossabaker](mailto:ross@rossabaker.com)
GitHub Security Advisory: GHSA-vc89-hccf-rq55
Package: org.typelevel:jawn-parserg (MAVEN)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-326: Inadequate Encryption Strength, CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 1.3.2
Patched in: unpatched

Summary: Hash collision in typelevel jawn

Details:
### Impact

Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack.  Most applications do not implement these traits directly, but inherit from a library:

Affected implementations include:
* `org.http4s` :: `http4s-play-json`
* `org.typelevel :: jawn-ast` (< 0.8.0)
* `org.typelevel :: jawn-play` (discontinued)
* `org.typelevel :: jawn-rojoma` (discontinued)
* `org.typelevel :: jawn-spray` (discontinued)

Unaffected implementations include:
* `io.argonaut :: argonaut-jawn`
* `io.circe :: circe-parser`
* `org.typelevel :: jawn-ast` (>= 0.8.0)
* `org.typelevel :: jawn-json4s` (discontinued)
* `org.typelevel :: jawn-argonaut` (discontinued)

### Patches

`jawn-parser-1.3.2` fixes the issue.

### Workarounds

Override `objectContext()` to use a collision-safe collection.  See [the patch](https://github.com/typelevel/jawn/pull/390/files) for an example in both `SimpleFacade` and `MutableFacade`.

### References

* https://github.com/typelevel/jawn/pull/390

### Credits

* @kag0, for the report and the patch

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [typelevel/jawn](https://github.com/typelevel/jawn)
* E-mail a maintainer:
  * [@rossabaker](mailto:ross@rossabaker.com)
GitHub Security Advisory: GHSA-vc89-hccf-rq55
Package: org.typelevel:jawn-parser_0.25 (MAVEN)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-326: Inadequate Encryption Strength, CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 1.3.2
Patched in: unpatched

Summary: Hash collision in typelevel jawn

Details:
### Impact

Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack.  Most applications do not implement these traits directly, but inherit from a library:

Affected implementations include:
* `org.http4s` :: `http4s-play-json`
* `org.typelevel :: jawn-ast` (< 0.8.0)
* `org.typelevel :: jawn-play` (discontinued)
* `org.typelevel :: jawn-rojoma` (discontinued)
* `org.typelevel :: jawn-spray` (discontinued)

Unaffected implementations include:
* `io.argonaut :: argonaut-jawn`
* `io.circe :: circe-parser`
* `org.typelevel :: jawn-ast` (>= 0.8.0)
* `org.typelevel :: jawn-json4s` (discontinued)
* `org.typelevel :: jawn-argonaut` (discontinued)

### Patches

`jawn-parser-1.3.2` fixes the issue.

### Workarounds

Override `objectContext()` to use a collision-safe collection.  See [the patch](https://github.com/typelevel/jawn/pull/390/files) for an example in both `SimpleFacade` and `MutableFacade`.

### References

* https://github.com/typelevel/jawn/pull/390

### Credits

* @kag0, for the report and the patch

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [typelevel/jawn](https://github.com/typelevel/jawn)
* E-mail a maintainer:
  * [@rossabaker](mailto:ross@rossabaker.com)
GitHub Security Advisory: GHSA-m9gh-789g-q5pv
Package: org.elasticsearch:elasticsearch (MAVEN)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-287: Improper Authentication, CWE-295: Improper Certificate Validation
Vulnerable versions: >= 9.2.0, < 9.2.2
Patched in: 9.2.2

Summary: Elasticsearch PKI Realm Authentication Bypass Vulnerability Allows User Impersonation Through Crafted Client Certificates

Details:
Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.
GitHub Security Advisory: GHSA-m9gh-789g-q5pv
Package: org.elasticsearch:elasticsearch (MAVEN)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-287: Improper Authentication, CWE-295: Improper Certificate Validation
Vulnerable versions: >= 9.0.0-beta1, < 9.1.8
Patched in: 9.1.8

Summary: Elasticsearch PKI Realm Authentication Bypass Vulnerability Allows User Impersonation Through Crafted Client Certificates

Details:
Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.
GitHub Security Advisory: GHSA-m9gh-789g-q5pv
Package: org.elasticsearch:elasticsearch (MAVEN)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-287: Improper Authentication, CWE-295: Improper Certificate Validation
Vulnerable versions: >= 7.0.0-alpha1, < 8.19.8
Patched in: 8.19.8

Summary: Elasticsearch PKI Realm Authentication Bypass Vulnerability Allows User Impersonation Through Crafted Client Certificates

Details:
Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.
GitHub Security Advisory: GHSA-3f8c-8h8v-p54h
Package: com.aizuda:snail-job (MAVEN)
Severity: MODERATE (CVSS 6.3)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: < 1.7.0-beta1
Patched in: 1.7.0-beta1

Summary: snail-job is vulnerable to Code Injection through QLExpressEngine.doEval function

Details:
A vulnerability was found in aizuda snail-job up to 1.6.0. Affected by this vulnerability is the function QLExpressEngine.doEval of the file snail-job-common/snail-job-common-core/src/main/java/com/aizuda/snailjob/common/core/expression/strategy/QLExpressEngine.java. The manipulation results in injection. The attack can be launched remotely. Upgrading to version 1.7.0-beta1 addresses this issue. The patch is identified as 978f316c38b3d68bb74d2489b5e5f721f6675e86. The affected component should be upgraded.
GitHub Security Advisory: GHSA-6gvq-jcmp-8959
Package: org.altcha:altcha (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-115: Misinterpretation of Input, CWE-347: Improper Verification of Cryptographic Signature
Vulnerable versions: < 1.3.0
Patched in: 1.3.0

Summary: ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay

Details:
### Impact

A cryptographic semantic binding flaw in ALTCHA libraries allows challenge payload splicing, which may enable replay attacks. The HMAC signature does not unambiguously bind challenge parameters to the nonce, allowing an attacker to reinterpret a valid proof-of-work submission with a modified expiration value. This may allow previously solved challenges to be reused beyond their intended lifetime, depending on server-side replay handling and deployment assumptions.

The vulnerability primarily impacts abuse-prevention mechanisms such as rate limiting and bot mitigation. It does not directly affect data confidentiality or integrity. 

### Patches

This issue has been addressed by enforcing explicit semantic separation between challenge parameters and the nonce during HMAC computation.

Users are advised to upgrade to patched versions.

### Workarounds

As a mitigation, implementations may append a delimiter to the end of the `salt` value prior to HMAC computation (for example, `<salt>?expires=<time>&`). This prevents ambiguity between parameters and the nonce and is backward-compatible with existing implementations, as the delimiter is treated as a standard URL parameter separator.
GitHub Security Advisory: GHSA-84h7-rjj3-6jx4
Package: io.netty:netty-codec-http (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
Vulnerable versions: < 4.1.129.Final
Patched in: 4.1.129.Final

Summary: Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder

Details:
### Summary

The `io.netty.handler.codec.http.HttpRequestEncoder` CRLF injection with the request uri when constructing a request. This leads to request smuggling when `HttpRequestEncoder` is used without proper sanitization of the uri.

### Details

The `HttpRequestEncoder` simply UTF8 encodes the `uri` without sanitization (`buf.writeByte(SP).writeCharSequence(uriCharSequence, CharsetUtil.UTF_8);`)

The default implementation of HTTP headers guards against such possibility already with a validator making it impossible with headers.

### PoC

Simple reproducer:

```java
public static void main(String[] args) {

  EmbeddedChannel client = new EmbeddedChannel();
  client.pipeline().addLast(new HttpClientCodec());

  EmbeddedChannel server = new EmbeddedChannel();
  server.pipeline().addLast(new HttpServerCodec());
  server.pipeline().addLast(new ChannelInboundHandlerAdapter() {
    @Override
    public void channelRead(ChannelHandlerContext ctx, Object msg) throws Exception {
      System.out.println("Processing msg " + msg);
    }
  });

  DefaultHttpRequest request = new DefaultHttpRequest(
    HttpVersion.HTTP_1_1,
    HttpMethod.GET,
    "/s1 HTTP/1.1\r\n" +
      "\r\n" +
      "POST /s2 HTTP/1.1\r\n" +
      "content-length: 11\r\n\r\n" +
      "Hello World" +
      "GET /s1"
  );
  client.writeAndFlush(request);
  ByteBuf tmp;
  while ((tmp = client.readOutbound()) != null) {
    server.writeInbound(tmp);
  }
}
```

### Impact

Any application / framework using `HttpRequestEncoder` can be subject to be abused to perform request smuggling using CRLF injection.
GitHub Security Advisory: GHSA-84h7-rjj3-6jx4
Package: io.netty:netty-codec-http (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
Vulnerable versions: >= 4.2.0.Alpha1, < 4.2.8.Final
Patched in: 4.2.8.Final

Summary: Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder

Details:
### Summary

The `io.netty.handler.codec.http.HttpRequestEncoder` CRLF injection with the request uri when constructing a request. This leads to request smuggling when `HttpRequestEncoder` is used without proper sanitization of the uri.

### Details

The `HttpRequestEncoder` simply UTF8 encodes the `uri` without sanitization (`buf.writeByte(SP).writeCharSequence(uriCharSequence, CharsetUtil.UTF_8);`)

The default implementation of HTTP headers guards against such possibility already with a validator making it impossible with headers.

### PoC

Simple reproducer:

```java
public static void main(String[] args) {

  EmbeddedChannel client = new EmbeddedChannel();
  client.pipeline().addLast(new HttpClientCodec());

  EmbeddedChannel server = new EmbeddedChannel();
  server.pipeline().addLast(new HttpServerCodec());
  server.pipeline().addLast(new ChannelInboundHandlerAdapter() {
    @Override
    public void channelRead(ChannelHandlerContext ctx, Object msg) throws Exception {
      System.out.println("Processing msg " + msg);
    }
  });

  DefaultHttpRequest request = new DefaultHttpRequest(
    HttpVersion.HTTP_1_1,
    HttpMethod.GET,
    "/s1 HTTP/1.1\r\n" +
      "\r\n" +
      "POST /s2 HTTP/1.1\r\n" +
      "content-length: 11\r\n\r\n" +
      "Hello World" +
      "GET /s1"
  );
  client.writeAndFlush(request);
  ByteBuf tmp;
  while ((tmp = client.readOutbound()) != null) {
    server.writeInbound(tmp);
  }
}
```

### Impact

Any application / framework using `HttpRequestEncoder` can be subject to be abused to perform request smuggling using CRLF injection.
GitHub Security Advisory: GHSA-m5gv-vj3f-6v2p
Package: com.liferay:com.liferay.object.service (MAVEN)
Severity: HIGH (CVSS 7.2)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 1.0.96
Patched in: 1.0.96

Summary: Liferay Portal and DXP Instance Admin can execute code using Objects Actions and Validations

Details:
In Liferay Portal 7.4.3.27 through 7.4.3.42, and Liferay DXP 2024.Q1.1 through 2024.Q1.20, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 27 through update 42 (Liferay PaaS, and Liferay Self-Hosted), the Objects module does not restrict the use of Groovy scripts in Object actions for Admin Users. This allows remote authenticated admin users with the Instance Administrator role to execute arbitrary Groovy scripts (i.e., remote code execution) through Object actions. 

In contrast, in Liferay DXP (Liferay SaaS), the use of Groovy in Object actions is not allowed due to the high security risks it poses. 

Starting from Liferay DXP 2024.Q2 and later, a new feature has been introduced in Instance Settings that allows administrators to configure whether Groovy scripts are allowed in their instances.
GitHub Security Advisory: GHSA-vx9q-rhv9-3jvg
Package: io.airlift:aircompressor-v3 (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-125: Out-of-bounds Read, CWE-201: Insertion of Sensitive Information Into Sent Data
Vulnerable versions: < 3.4
Patched in: 3.4

Summary: aircompressor Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer

Details:
### Summary
Incorrect handling of malformed data in Java-based decompressor implementations for Snappy and LZ4 allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is reused without being cleared, this may lead to disclosure of sensitive data.

### Details
With certain crafted compressed inputs, elements from the output buffer can end up in the uncompressed output. This is relevant for applications that reuse the same output buffer to uncompress multiple inputs. This can be the case of a web server that allocates a fix-sized buffer for performance purposes. This is similar to [GHSA-cmp6-m4wj-q63q](https://github.com/yawkat/lz4-java/security/advisories/GHSA-cmp6-m4wj-q63q).

### Impact
Applications using aircompressor as described above may leak sensitive information to external unauthorized attackers.

### Mitigation

The vulnerability is fixed in release 3.4 and 2.0.3. However, it can be mitigated by either:
* Avoiding reuse of the decompression buffer across calls
* Clearing the decompression buffer before a call to decompress data
GitHub Security Advisory: GHSA-3hg2-rh4r-8qf6
Package: org.apache.streampark:streampark (MAVEN)
Severity: HIGH (CVSS 5.9)
CWE: CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation
Vulnerable versions: >= 2.0.0, < 2.1.7
Patched in: 2.1.7

Summary: Apache StreamPark: Use the user’s password as the secret key Vulnerability

Details:
When encrypting sensitive data, weak encryption keys that are fixed or directly generated based on user passwords are used. Attackers can obtain these keys through methods such as reverse engineering, code leaks, or password guessing, thereby decrypting stored or transmitted encrypted data, leading to the leakage of sensitive information.

This issue affects Apache StreamPark: from 2.0.0 before 2.1.7.

Users are recommended to upgrade to version 2.1.7, which fixes the issue.
GitHub Security Advisory: GHSA-749j-2hp6-8cxm
Package: org.apache.streampark:streampark (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Vulnerable versions: >= 2.0.0, < 2.1.7
Patched in: 2.1.7

Summary: Apache StreamPark uses a Weak Encryption Algorithm

Details:
Weak Encryption Algorithm in StreamPark, The use of an AES cipher in ECB mode and a weak random number generator for encrypting sensitive data, including JWT tokens, may have risked exposing sensitive authentication data

This issue affects Apache StreamPark: from 2.0.0 before 2.1.7.

Users are recommended to upgrade to version 2.1.7, which fixes the issue.
GitHub Security Advisory: GHSA-prv5-c2px-j9q3
Package: org.apache.streampark:streampark (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-321: Use of Hard-coded Cryptographic Key, CWE-798: Use of Hard-coded Credentials
Vulnerable versions: >= 2.0.0, < 2.1.7
Patched in: 2.1.7

Summary: Apache StreamPark has a hard-coded encryption key

Details:
In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists. This vulnerability occurs because the system uses a fixed, immutable key for encryption instead of dynamically generating or securely configuring the key. Attackers may obtain this key through reverse engineering or code analysis, potentially decrypting sensitive data or forging encrypted information, leading to information disclosure or unauthorized system access.

This issue affects Apache StreamPark: from 2.0.0 before 2.1.7.

Users are recommended to upgrade to version 2.1.7, which fixes the issue.
GitHub Security Advisory: GHSA-q37j-3367-fwv7
Package: org.apache.hugegraph:hg-pd-core (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 1.7.0
Patched in: 1.7.0

Summary: Apache HugeGraph-Server: RAFT and deserialization vulnerability

Details:
A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process against object injection attacks.

Users are recommended to upgrade to version 1.7.0, which fixes the issue.