PT-2024-31590 · Apache · Apache Druid

Mr-N30 · Published 2024-09-17 · Updated 2024-10-02 · CVE-2024-45384

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Druid versions 0.18.0 through 30.0.0

Description The issue is a Padding Oracle vulnerability in the Apache Druid extension, druid-pac4j, which could allow an attacker to manipulate a pac4j session cookie. Since the druid-pac4j extension is optional and disabled by default, Druid installations not using the druid-pac4j extension are not affected by this issue. While there is no known way to meaningfully exploit this flaw, it is recommended to take precautions.

Recommendations For Apache Druid versions 0.18.0 through 30.0.0, upgrade to version 30.0.1 or higher to fix the issue. Ensure a strong druid.auth.pac4j.cookiePassphrase is set as a precaution.

Fix

Generation of Error Message Containing Sensitive Information

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-209

CWE-347

Related Identifiers

CVE-2024-45384

GHSA-P72W-R6FV-6G5H

Affected Products

Apache Druid

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2024-45384 · Security Note
• https://osv.dev/vulnerability/GHSA-p72w-r6fv-6g5h · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-45384 · Vendor Advisory
• https://lists.apache.org/thread/gr94fnp574plb50lsp8jw4smvgv1lbz1 · Vendor Advisory
• https://github.com/apache/druid · Note
• https://github.com/apache/druid/releases/tag/druid-30.0.1 · Note
• https://github.com/apache/druid/commit/74cab7a76c99da457c3a883939cc0b03301b8771 · Note
• https://twitter.com/CVEnew/status/1836116166005166136 · Twitter Post
• http://openwall.com/lists/oss-security/2024/09/17/1 · Note
• https://t.me/cvenotify/96802 · Telegram Post
• https://t.me/cvedetector/5837 · Telegram Post
• https://twitter.com/mr_n30/status/1839689717169746338 · Twitter Post
• https://twitter.com/oss_security/status/1836164092937052497 · Twitter Post