oss-security - CVE-2024-45384: Apache Druid: Padding oracle in druid-pac4j extension that allows an attacker to manipulate a pac4j session cookie via Padding Oracle Attack

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <d2594e2b-af02-22f0-bcd8-aac050704e3a@apache.org>
Date: Tue, 17 Sep 2024 17:52:08 +0000
From: Karan Kumar <karan@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2024-45384: Apache Druid: Padding oracle in druid-pac4j
 extension that allows an attacker to manipulate a pac4j session cookie via
 Padding Oracle Attack 

Severity: low

Affected versions:

- Apache Druid 0.18.0 through 30.0.0

Description:

Padding Oracle vulnerability in Apache Druid extension, druid-pac4j.
This could allow an attacker to manipulate a pac4j session cookie.

This issue affects Apache Druid versions 0.18.0 through 30.0.0.
Since the druid-pac4j extension is optional and disabled by default, Druid installations not using the druid-pac4j extension are not affected by this vulnerability.

While we are not aware of a way to meaningfully exploit this flaw, we 
nevertheless recommend upgrading to version 30.0.1 or higher which fixes the issue
and ensuring you have a strong 
druid.auth.pac4j.cookiePassphrase as a precaution.

Credit:

mr-n30 (reporter)

References:

https://druid.apache.org
https://www.cve.org/CVERecord?id=CVE-2024-45384

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.