CVE-2025-54947: Apache StreamPark: Use hard-coded key vulnerability
In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists. This vulnerability occurs because the system uses a fixed, immutable key for encryption instead of dynamically generating or securely configuring the key. Attackers may obtain this key through reverse engineering or code analysis, potentially decrypting sensitive data or forging encrypted information, leading to information disclosure or unauthorized system access.
This issue affects Apache StreamPark: from 2.0.0 before 2.1.7.
Users are recommended to upgrade to version 2.1.7, which fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54947?
The severity of CVE-2025-54947 is classified as high due to the use of a hard-coded encryption key.
How do I fix CVE-2025-54947?
To fix CVE-2025-54947, upgrade Apache StreamPark to a version later than 2.1.7 where this vulnerability is addressed.
What versions of Apache StreamPark are affected by CVE-2025-54947?
Apache StreamPark versions 2.0.0 through 2.1.7 are affected by CVE-2025-54947.
What impact does CVE-2025-54947 have on security?
CVE-2025-54947 can lead to unauthorized data access if the hard-coded key is exposed to attackers.
Is there a workaround for CVE-2025-54947 before upgrading?
There are no effective workarounds for CVE-2025-54947, and upgrading is the recommended action.