CVE-2025-59390

{"id": "CVE-2025-59390", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2025-11-26T09:15:46.033", "references": [{"url": "https://lists.apache.org/thread/jwjltllnntgj1sb9wzsjmvwm9f8rlhg8", "tags": ["Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2025/11/26/1", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-338"}]}], "descriptions": [{"lang": "en", "value": "Apache Druid\u2019s Kerberos authenticator uses a weak fallback secret when the `druid.auth.authenticator.kerberos.cookieSignatureSecret` configuration is not explicitly set. In this case, the secret is generated using `ThreadLocalRandom`,\n which is not a crypto-graphically secure random number generator. This \nmay allow an attacker to predict or brute force the secret used to sign \nauthentication cookies, potentially enabling token forgery or \nauthentication bypass. Additionally, each process generates its own \nfallback secret, resulting in inconsistent secrets across nodes. This \ncauses authentication failures in distributed or multi-broker \ndeployments, effectively leading to a incorrectly configured clusters. Users are \nadvised to configure a strong\u00a0`druid.auth.authenticator.kerberos.cookieSignatureSecret`\n\n\n\nThis issue affects Apache Druid: through 34.0.0.\n\nUsers are recommended to upgrade to version 35.0.0, which fixes the issue making it mandatory to set `druid.auth.authenticator.kerberos.cookieSignatureSecret` when using the\u00a0Kerberos authenticator. Services will fail to come up if the secret is not set."}, {"lang": "es", "value": "El autenticador Kerberos de Apache Druid utiliza un secreto de respaldo d\u00e9bil cuando la configuraci\u00f3n `druid.auth.authenticator.kerberos.cookieSignatureSecret` no se establece expl\u00edcitamente. En este caso, el secreto se genera utilizando `ThreadLocalRandom`, que no es un generador de n\u00fameros aleatorios criptogr\u00e1ficamente seguro. Esto puede permitir a un atacante predecir o forzar por fuerza bruta el secreto utilizado para firmar las cookies de autenticaci\u00f3n, lo que podr\u00eda permitir la falsificaci\u00f3n de tokens o eludir la autenticaci\u00f3n. Adem\u00e1s, cada proceso genera su propio secreto de respaldo, lo que da lugar a secretos inconsistentes entre los nodos. Esto provoca fallos de autenticaci\u00f3n en implementaciones distribuidas o con m\u00faltiples brokers, lo que conduce efectivamente a cl\u00fasteres configurados incorrectamente. Se recomienda a los usuarios que configuren un `druid.auth.authenticator.kerberos.cookieSignatureSecret` fuerte. Este problema afecta a Apache Druid: hasta la versi\u00f3n 34.0.0. Se recomienda a los usuarios que actualicen a la versi\u00f3n 35.0.0, que corrige el problema y hace obligatorio establecer `druid.auth.authenticator.kerberos.cookieSignatureSecret` cuando se utiliza el autenticador Kerberos. Los servicios no se iniciar\u00e1n si no se establece el secreto."}], "lastModified": "2025-12-04T16:09:22.300", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:druid:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7C05CCA2-CAD4-448C-B893-BDA365E75D0C", "versionEndExcluding": "35.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}