CVE-2021-45458 (GCVE-0-2021-45458)
Vulnerability from cvelistv5 – Published: 2022-01-06 12:35 – Updated: 2024-08-04 04:39
VLAI
Title
Hardcoded credentials
Summary
Apache Kylin provides encryption classes PasswordPlaceholderConfigurer to help users encrypt their passwords. In the encryption algorithm used by this encryption class, the cipher is initialized with a hardcoded key and IV. If users use class PasswordPlaceholderConfigurer to encrypt their password and configure it into kylin's configuration file, there is a risk that the password may be decrypted. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.
Severity
No CVSS data available.
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/oof215qz188k16vhl… | x_refsource_MISC |
| http://www.openwall.com/lists/oss-security/2022/01/06/7 | mailing-listx_refsource_MLIST |
| http://www.openwall.com/lists/oss-security/2022/01/06/3 | mailing-listx_refsource_MLIST |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Kylin |
Affected:
Apache Kylin 2 , ≤ 2.6.6
(custom)
Affected: Apache Kylin 3 , ≤ 3.1.2 (custom) Affected: Apache Kylin 4 , ≤ 4.0.0 (custom) |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T04:39:21.117Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://lists.apache.org/thread/oof215qz188k16vhlo97cm1jksxdowfy"
},
{
"name": "[oss-security] 20220106 CVE-2021-45458: Apache Kylin: Hardcoded credentials",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2022/01/06/7"
},
{
"name": "[oss-security] 20220106 CVE-2021-45458: Apache Kylin: Hardcoded credentials",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2022/01/06/3"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Apache Kylin",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "2.6.6",
"status": "affected",
"version": "Apache Kylin 2",
"versionType": "custom"
},
{
"lessThanOrEqual": "3.1.2",
"status": "affected",
"version": "Apache Kylin 3",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.0.0",
"status": "affected",
"version": "Apache Kylin 4",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Alvaro Munoz \u003cpwntester@github.com\u003e"
}
],
"descriptions": [
{
"lang": "en",
"value": "Apache Kylin provides encryption classes PasswordPlaceholderConfigurer to help users encrypt their passwords. In the encryption algorithm used by this encryption class, the cipher is initialized with a hardcoded key and IV. If users use class PasswordPlaceholderConfigurer to encrypt their password and configure it into kylin\u0027s configuration file, there is a risk that the password may be decrypted. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions."
}
],
"metrics": [
{
"other": {
"content": {
"other": "moderate"
},
"type": "unknown"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-01-06T15:06:18.000Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://lists.apache.org/thread/oof215qz188k16vhlo97cm1jksxdowfy"
},
{
"name": "[oss-security] 20220106 CVE-2021-45458: Apache Kylin: Hardcoded credentials",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2022/01/06/7"
},
{
"name": "[oss-security] 20220106 CVE-2021-45458: Apache Kylin: Hardcoded credentials",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2022/01/06/3"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Hardcoded credentials",
"workarounds": [
{
"lang": "en",
"value": "Users of Kylin 2.x \u0026 Kylin 3.x should upgrade to 3.1.3 or apply patch https://github.com/apache/kylin/pull/1782.\nUsers of Kylin 4.x should upgrade to 4.0.1 or apply patch https://github.com/apache/kylin/pull/1781.\n\nAfter upgrading, users can configure the value of `kylin.security.encrypt.cipher.ivSpec` in kylin.properties for encryption algorithm, and then re-encrypt the password they need to encrypt."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@apache.org",
"ID": "CVE-2021-45458",
"STATE": "PUBLIC",
"TITLE": "Hardcoded credentials"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Apache Kylin",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "Apache Kylin 2",
"version_value": "2.6.6"
},
{
"version_affected": "\u003c=",
"version_name": "Apache Kylin 3",
"version_value": "3.1.2"
},
{
"version_affected": "\u003c=",
"version_name": "Apache Kylin 4",
"version_value": "4.0.0"
}
]
}
}
]
},
"vendor_name": "Apache Software Foundation"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Alvaro Munoz \u003cpwntester@github.com\u003e"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Apache Kylin provides encryption classes PasswordPlaceholderConfigurer to help users encrypt their passwords. In the encryption algorithm used by this encryption class, the cipher is initialized with a hardcoded key and IV. If users use class PasswordPlaceholderConfigurer to encrypt their password and configure it into kylin\u0027s configuration file, there is a risk that the password may be decrypted. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": [
{
"other": "moderate"
}
],
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-798 Use of Hard-coded Credentials"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://lists.apache.org/thread/oof215qz188k16vhlo97cm1jksxdowfy",
"refsource": "MISC",
"url": "https://lists.apache.org/thread/oof215qz188k16vhlo97cm1jksxdowfy"
},
{
"name": "[oss-security] 20220106 CVE-2021-45458: Apache Kylin: Hardcoded credentials",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2022/01/06/7"
},
{
"name": "[oss-security] 20220106 CVE-2021-45458: Apache Kylin: Hardcoded credentials",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2022/01/06/3"
}
]
},
"source": {
"discovery": "UNKNOWN"
},
"work_around": [
{
"lang": "en",
"value": "Users of Kylin 2.x \u0026 Kylin 3.x should upgrade to 3.1.3 or apply patch https://github.com/apache/kylin/pull/1782.\nUsers of Kylin 4.x should upgrade to 4.0.1 or apply patch https://github.com/apache/kylin/pull/1781.\n\nAfter upgrading, users can configure the value of `kylin.security.encrypt.cipher.ivSpec` in kylin.properties for encryption algorithm, and then re-encrypt the password they need to encrypt."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2021-45458",
"datePublished": "2022-01-06T12:35:24.000Z",
"dateReserved": "2021-12-21T00:00:00.000Z",
"dateUpdated": "2024-08-04T04:39:21.117Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2021-45458",
"date": "2026-06-01",
"epss": "0.00631",
"percentile": "0.70627"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2.0.0\", \"versionEndIncluding\": \"2.6.6\", \"matchCriteriaId\": \"7ED3ED46-D80F-4D42-9973-9F075B946351\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.0.0\", \"versionEndExcluding\": \"3.1.3\", \"matchCriteriaId\": \"5EB6EBBD-9C39-45B1-9EED-9D99228D0D76\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:kylin:4.0.0:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"A9ED56E6-4BD6-410A-894C-350295DB8443\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:kylin:4.0.0:alpha:*:*:*:*:*:*\", \"matchCriteriaId\": \"7CBD3E44-4EB4-474D-911C-3C1ED9061DCE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:kylin:4.0.0:beta:*:*:*:*:*:*\", \"matchCriteriaId\": \"BE87BCCF-8188-44F3-A727-808A8D6C45B9\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"Apache Kylin provides encryption classes PasswordPlaceholderConfigurer to help users encrypt their passwords. In the encryption algorithm used by this encryption class, the cipher is initialized with a hardcoded key and IV. If users use class PasswordPlaceholderConfigurer to encrypt their password and configure it into kylin\u0027s configuration file, there is a risk that the password may be decrypted. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.\"}, {\"lang\": \"es\", \"value\": \"Apache Kylin proporciona clases de cifrado PasswordPlaceholderConfigurer para ayudar a usuarios a cifrar sus contrase\\u00f1as. En el algoritmo de cifrado usado por esta clase de cifrado, el cifrado es inicializado con una clave y un IV embebidos. Si los usuarios usan la clase PasswordPlaceholderConfigurer para cifrar su contrase\\u00f1a y la configuran en el archivo de configuraci\\u00f3n de kylin, se presenta el riesgo de que la contrase\\u00f1a pueda ser descifrada. Este problema afecta a Apache Kylin 2 versiones 2.6.6 y anteriores; Apache Kylin 3 versiones 3.1.2 y anteriores; Apache Kylin 4 versiones 4.0.0 y anteriores.\"}]",
"id": "CVE-2021-45458",
"lastModified": "2024-11-21T06:32:14.937",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:P/I:N/A:N\", \"baseScore\": 5.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 10.0, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2022-01-06T13:15:08.330",
"references": "[{\"url\": \"http://www.openwall.com/lists/oss-security/2022/01/06/3\", \"source\": \"security@apache.org\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2022/01/06/7\", \"source\": \"security@apache.org\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.apache.org/thread/oof215qz188k16vhlo97cm1jksxdowfy\", \"source\": \"security@apache.org\", \"tags\": [\"Mailing List\", \"Vendor Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2022/01/06/3\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2022/01/06/7\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.apache.org/thread/oof215qz188k16vhlo97cm1jksxdowfy\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Vendor Advisory\"]}]",
"sourceIdentifier": "security@apache.org",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"security@apache.org\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-798\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-330\"}, {\"lang\": \"en\", \"value\": \"CWE-798\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2021-45458\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2022-01-06T13:15:08.330\",\"lastModified\":\"2024-11-21T06:32:14.937\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Apache Kylin provides encryption classes PasswordPlaceholderConfigurer to help users encrypt their passwords. In the encryption algorithm used by this encryption class, the cipher is initialized with a hardcoded key and IV. If users use class PasswordPlaceholderConfigurer to encrypt their password and configure it into kylin\u0027s configuration file, there is a risk that the password may be decrypted. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.\"},{\"lang\":\"es\",\"value\":\"Apache Kylin proporciona clases de cifrado PasswordPlaceholderConfigurer para ayudar a usuarios a cifrar sus contrase\u00f1as. En el algoritmo de cifrado usado por esta clase de cifrado, el cifrado es inicializado con una clave y un IV embebidos. Si los usuarios usan la clase PasswordPlaceholderConfigurer para cifrar su contrase\u00f1a y la configuran en el archivo de configuraci\u00f3n de kylin, se presenta el riesgo de que la contrase\u00f1a pueda ser descifrada. Este problema afecta a Apache Kylin 2 versiones 2.6.6 y anteriores; Apache Kylin 3 versiones 3.1.2 y anteriores; Apache Kylin 4 versiones 4.0.0 y anteriores.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:N/A:N\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-798\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-330\"},{\"lang\":\"en\",\"value\":\"CWE-798\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.0.0\",\"versionEndIncluding\":\"2.6.6\",\"matchCriteriaId\":\"7ED3ED46-D80F-4D42-9973-9F075B946351\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0.0\",\"versionEndExcluding\":\"3.1.3\",\"matchCriteriaId\":\"5EB6EBBD-9C39-45B1-9EED-9D99228D0D76\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:kylin:4.0.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"A9ED56E6-4BD6-410A-894C-350295DB8443\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:kylin:4.0.0:alpha:*:*:*:*:*:*\",\"matchCriteriaId\":\"7CBD3E44-4EB4-474D-911C-3C1ED9061DCE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:kylin:4.0.0:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"BE87BCCF-8188-44F3-A727-808A8D6C45B9\"}]}]}],\"references\":[{\"url\":\"http://www.openwall.com/lists/oss-security/2022/01/06/3\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2022/01/06/7\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.apache.org/thread/oof215qz188k16vhlo97cm1jksxdowfy\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2022/01/06/3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2022/01/06/7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.apache.org/thread/oof215qz188k16vhlo97cm1jksxdowfy\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Vendor Advisory\"]}]}}"
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…