Skip to content

Commit f099564

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-4jj9-cgqc-x9h5 GHSA-749j-2hp6-8cxm GHSA-prv5-c2px-j9q3 GHSA-749j-2hp6-8cxm
1 parent a07873c commit f099564

File tree

4 files changed

+166
-37
lines changed

4 files changed

+166
-37
lines changed

‎advisories/github-reviewed/2025/12/GHSA-4jj9-cgqc-x9h5/GHSA-4jj9-cgqc-x9h5.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4jj9-cgqc-x9h5",
4+
"modified": "2025-12-12T19:22:04Z",
5+
"published": "2025-12-12T19:22:04Z",
6+
"aliases": [
7+
"CVE-2025-66001"
8+
],
9+
"summary": "NeuVector OpenID Connect is vulnerable to man-in-the-middle (MITM)",
10+
"details": "### Impact\n\nNeuVector supports login authentication through OpenID Connect. However, the TLS verification (which verifies the remote server's authenticity and integrity) for OpenID Connect is not enforced by default. As a result this may expose the system to man-in-the-middle (MITM) attacks.\nStarting from version 5.4.0, NeuVector supports TLS verification for following connection types:\n\n- Registry Connections\n- Auth Server Connections (SAML, LDAP and OIDC)\n- Webhook Connections\n\nBy default, TLS verification remains disabled, and its configuration is located under **Settings > Configuration in the NeuVector UI**.\n\nIn the patched version, the new NeuVector deployment enables TLS verification by default. \nFor rolling upgrades, NeuVector does not automatically change this setting to prevent disruptions.\n\n**Note:** When \"TLS verification\" is enabled, it affects all connections to:\n\n- Registry servers\n- Auth servers (SAML, LDAP and OIDC)\n- Webhook servers\n\n### Patches\n\nPatched versions include release v5.4.8 and above.\n\n### Workarounds\n\nTo manually enable TLS verification:\n\n1. Open the NeuVector UI.\n2. Navigate to **Settings > Configuration**.\n3. In the **TLS Self-Signed Certificate Configuration** section, select **Enable TLS verification**.\n4. (Optional) Upload or paste the **TLS self-signed certificate**.\n\n### References\n\nIf you have any questions or comments about this advisory:\n\n- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.\n- Open an issue in the [NeuVector](https://github.com/neuvector/neuvector/issues/new/choose) repository.\n- Verify with our [support matrix](https://www.suse.com/suse-neuvector/support-matrix/all-supported-versions/neuvector-v-all-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/#suse-security).",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/neuvector/neuvector"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "5.3.0"
29+
},
30+
{
31+
"fixed": "5.4.8"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/neuvector/neuvector/security/advisories/GHSA-4jj9-cgqc-x9h5"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/neuvector/neuvector/commit/955904b5762f296d209bf395a5fcc7a40a53c424"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/neuvector/neuvector"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-295"
55+
],
56+
"severity": "HIGH",
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2025-12-12T19:22:04Z",
59+
"nvd_published_at": null
60+
}
61+
}

‎advisories/github-reviewed/2025/12/GHSA-749j-2hp6-8cxm/GHSA-749j-2hp6-8cxm.json‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-749j-2hp6-8cxm",
4+
"modified": "2025-12-12T19:23:11Z",
5+
"published": "2025-12-12T15:30:42Z",
6+
"aliases": [
7+
"CVE-2025-54981"
8+
],
9+
"summary": "Apache StreamPark uses a Weak Encryption Algorithm",
10+
"details": "Weak Encryption Algorithm in StreamPark, The use of an AES cipher in ECB mode and a weak random number generator for encrypting sensitive data, including JWT tokens, may have risked exposing sensitive authentication data\n\nThis issue affects Apache StreamPark: from 2.0.0 before 2.1.7.\n\nUsers are recommended to upgrade to version 2.1.7, which fixes the issue.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.apache.streampark:streampark"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "2.0.0"
29+
},
30+
{
31+
"fixed": "2.1.7"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54981"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/apache/streampark/commit/39034db0c806168afa82e58e4f376e1e3c3b73e4"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/apache/streampark"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://lists.apache.org/thread/9rbvdvwg5fdhzjdgyrholgso53r26998"
54+
}
55+
],
56+
"database_specific": {
57+
"cwe_ids": [
58+
"CWE-327"
59+
],
60+
"severity": "HIGH",
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2025-12-12T19:23:11Z",
63+
"nvd_published_at": "2025-12-12T15:15:53Z"
64+
}
65+
}

advisories/unreviewed/2025/12/GHSA-prv5-c2px-j9q3/GHSA-prv5-c2px-j9q3.json renamed to advisories/github-reviewed/2025/12/GHSA-prv5-c2px-j9q3/GHSA-prv5-c2px-j9q3.json

Lines changed: 40 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,53 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-prv5-c2px-j9q3",
4-
"modified": "2025-12-12T15:30:41Z",
4+
"modified": "2025-12-12T19:22:52Z",
55
"published": "2025-12-12T15:30:41Z",
66
"aliases": [
77
"CVE-2025-54947"
88
],
9+
"summary": "Apache StreamPark has a hard-coded encryption key",
910
"details": "In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists. This vulnerability occurs because the system uses a fixed, immutable key for encryption instead of dynamically generating or securely configuring the key. Attackers may obtain this key through reverse engineering or code analysis, potentially decrypting sensitive data or forging encrypted information, leading to information disclosure or unauthorized system access.\n\nThis issue affects Apache StreamPark: from 2.0.0 before 2.1.7.\n\nUsers are recommended to upgrade to version 2.1.7, which fixes the issue.",
10-
"severity": [],
11-
"affected": [],
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.apache.streampark:streampark"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "2.0.0"
29+
},
30+
{
31+
"fixed": "2.1.7"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1238
"references": [
1339
{
1440
"type": "ADVISORY",
1541
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54947"
1642
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/apache/streampark/commit/39034db0c806168afa82e58e4f376e1e3c3b73e4"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/apache/streampark"
50+
},
1751
{
1852
"type": "WEB",
1953
"url": "https://lists.apache.org/thread/kdntmzyzrco75x9q6mc6s8lty1fxmog1"
@@ -23,9 +57,9 @@
2357
"cwe_ids": [
2458
"CWE-321"
2559
],
26-
"severity": null,
27-
"github_reviewed": false,
28-
"github_reviewed_at": null,
60+
"severity": "HIGH",
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2025-12-12T19:22:52Z",
2963
"nvd_published_at": "2025-12-12T15:15:53Z"
3064
}
3165
}

‎advisories/unreviewed/2025/12/GHSA-749j-2hp6-8cxm/GHSA-749j-2hp6-8cxm.json‎

Lines changed: 0 additions & 31 deletions
This file was deleted.

0 commit comments

Comments
 (0)