465 matches found
GHSA-VP98-W2P3-MV35 vulnerabilities
Vulnerabilities for packages: druid...
GHSA-W9P3-5CR8-M3JJ vulnerabilities
Vulnerabilities for packages: druid...
GHSA-F7VH-QWP3-X37M vulnerabilities
Vulnerabilities for packages: druid...
GHSA-CGP8-4M63-FHH5 vulnerabilities
Vulnerabilities for packages: druid, spark...
GHSA-65FG-84F6-3JQ3 vulnerabilities
Vulnerabilities for packages: druid...
GHSA-2QRG-X229-3V8Q vulnerabilities
Vulnerabilities for packages: druid...
CVE-2021-29425 vulnerabilities
Vulnerabilities for packages: druid, hadoop-fips...
CVE-2023-26464 vulnerabilities
Vulnerabilities for packages: druid...
GHSA-GWRP-PVRQ-JMWV vulnerabilities
Vulnerabilities for packages: druid, hadoop-fips...
CVE-2022-23307 vulnerabilities
Vulnerabilities for packages: druid...
CVE-2022-23302 vulnerabilities
Vulnerabilities for packages: druid...
CVE-2021-4104 vulnerabilities
Vulnerabilities for packages: druid...
CVE-2021-37533 vulnerabilities
Vulnerabilities for packages: druid, spark...
UBUNTU-CVE-2025-55816
HotelDruid v3.0.7 and before is vulnerable to Cross Site Scripting XSS in the /modificaapp.php file...
Weak Authentication
org.apache.druid, druid is vulnerable to Weak Authentication. The vulnerability is due to the Kerberos authenticator using a weak fallback secret generated with a non-cryptographically secure RNG when druid.auth.authenticator.kerberos.cookieSignatureSecret is not set, which allows an attacker to...
Apache Druid’s Kerberos authenticator uses a weak fallback secret
Apache Druid’s Kerberos authenticator uses a weak fallback secret when the druid.auth.authenticator.kerberos.cookieSignatureSecret configuration is not explicitly set. In this case, the secret is generated using ThreadLocalRandom, which is not a crypto-graphically secure random number generator...
GHSA-W88F-4875-99C8 Apache Druid’s Kerberos authenticator uses a weak fallback secret
Apache Druid’s Kerberos authenticator uses a weak fallback secret when the druid.auth.authenticator.kerberos.cookieSignatureSecret configuration is not explicitly set. In this case, the secret is generated using ThreadLocalRandom, which is not a crypto-graphically secure random number generator...
CVE-2025-59390
Apache Druid’s Kerberos authenticator uses a weak fallback secret when the druid.auth.authenticator.kerberos.cookieSignatureSecret configuration is not explicitly set. In this case, the secret is generated using ThreadLocalRandom, which is not a crypto-graphically secure random number generator...
CVE-2025-59390 Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly.
Apache Druid’s Kerberos authenticator uses a weak fallback secret when the druid.auth.authenticator.kerberos.cookieSignatureSecret configuration is not explicitly set. In this case, the secret is generated using ThreadLocalRandom, which is not a crypto-graphically secure random number generator...
CVE-2025-59390 Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly.
Apache Druid’s Kerberos authenticator uses a weak fallback secret when the druid.auth.authenticator.kerberos.cookieSignatureSecret configuration is not explicitly set. In this case, the secret is generated using ThreadLocalRandom, which is not a crypto-graphically secure random number generator...