GHSA-2X2G-32R7-P4X8 vulnerabilities

Vulnerabilities for packages: logstash, strimzi-kafka-operator, apache-nifi, druid, thingsboard...

CVE-2024-31141 vulnerabilities

Vulnerabilities for packages: logstash, strimzi-kafka-operator, apache-nifi, druid, thingsboard...

CVE-2024-31141 vulnerabilities

Vulnerabilities for packages: druid, strimzi-kafka-operator, apache-nifi, thingsboard, logstash...

GHSA-G8M5-722R-8WHQ vulnerabilities

Vulnerabilities for packages: druid, celeborn, strimzi-kafka-operator, apache-nifi, solr, apache-tika, kafka, confluent-kafka, spark, confluent-kafka-jre-bcfips, zookeeper-fips, cloudwatch-exporter, zookeeper, cassandra-reaper, spark-fips...

CVE-2024-8184 vulnerabilities

Vulnerabilities for packages: druid, celeborn, strimzi-kafka-operator, apache-nifi, solr, apache-tika, kafka, confluent-kafka, spark, confluent-kafka-jre-bcfips, zookeeper-fips, cloudwatch-exporter, zookeeper, cassandra-reaper, spark-fips...

Padding Oracle Attack

org.apache.druid.extensions : druid-pac4j and org.apache.druid : druid-processing is vulnerable to Padding Oracle Attack. The vulnerability is caused due to improper handling of cryptographic padding in the druid-pac4j extension, which could allow an attacker to manipulate a pac4j session cookie...

GHSA-P72W-R6FV-6G5H vulnerabilities

Vulnerabilities for packages: druid...

GHSA-JH66-3545-VPM7 Apache Druid: Users can provide MySQL JDBC properties not on allow list

Apache Druid allows users with certain permissions to read data from other database systems using JDBC. This functionality allows trusted users to set up Druid lookups or run ingestion tasks. Druid also allows administrators to configure a list of allowed properties that users are able to provide...

GHSA-P72W-R6FV-6G5H vulnerabilities

Vulnerabilities for packages: druid...

druid-pac4j, Apache Druid extension, has Padding Oracle vulnerability

Padding Oracle vulnerability in Apache Druid extension, druid-pac4j. This could allow an attacker to manipulate a pac4j session cookie. This issue affects Apache Druid versions 0.18.0 through 30.0.0. Since the druid-pac4j extension is optional and disabled by default, Druid installations not usin...

Apache Druid: Users can provide MySQL JDBC properties not on allow list

Apache Druid allows users with certain permissions to read data from other database systems using JDBC. This functionality allows trusted users to set up Druid lookups or run ingestion tasks. Druid also allows administrators to configure a list of allowed properties that users are able to provide...

GHSA-P72W-R6FV-6G5H druid-pac4j, Apache Druid extension, has Padding Oracle vulnerability

Padding Oracle vulnerability in Apache Druid extension, druid-pac4j. This could allow an attacker to manipulate a pac4j session cookie. This issue affects Apache Druid versions 0.18.0 through 30.0.0. Since the druid-pac4j extension is optional and disabled by default, Druid installations not usin...

CVE-2024-45537

Apache Druid allows users with certain permissions to read data from other database systems using JDBC. This functionality allows trusted users to set up Druid lookups or run ingestion tasks. Druid also allows administrators to configure a list of allowed properties that users are able to provide...

CVE-2024-45384

Padding Oracle vulnerability in Apache Druid extension, druid-pac4j. This could allow an attacker to manipulate a pac4j session cookie. This issue affects Apache Druid versions 0.18.0 through 30.0.0. Since the druid-pac4j extension is optional and disabled by default, Druid installations not usin...

CVE-2024-45384 vulnerabilities

Vulnerabilities for packages: druid...

CVE-2024-45384 vulnerabilities

Vulnerabilities for packages: druid...

CVE-2024-45537 Apache Druid: Users can provide MySQL JDBC properties not on allow list

Apache Druid allows users with certain permissions to read data from other database systems using JDBC. This functionality allows trusted users to set up Druid lookups or run ingestion tasks. Druid also allows administrators to configure a list of allowed properties that users are able to provide...

CVE-2024-45537

Apache Druid CVE-2024-45537 describes a vulnerability where an authenticated user can bypass authorization by sending a specially crafted MySQL JDBC connection string that includes properties not on the allow list, enabling access to read data from other databases via JDBC. The issue stems from i...

CVE-2024-45537 Apache Druid: Users can provide MySQL JDBC properties not on allow list

Apache Druid allows users with certain permissions to read data from other database systems using JDBC. This functionality allows trusted users to set up Druid lookups or run ingestion tasks. Druid also allows administrators to configure a list of allowed properties that users are able to provide...

CVE-2024-45537 Apache Druid: Users can provide MySQL JDBC properties not on allow list

Apache Druid allows users with certain permissions to read data from other database systems using JDBC. This functionality allows trusted users to set up Druid lookups or run ingestion tasks. Druid also allows administrators to configure a list of allowed properties that users are able to provide...