CVE-2024-45384: 
Java vulnerability analysis and mitigation

A Padding Oracle vulnerability was discovered in the Apache Druid extension druid-pac4j, affecting versions 0.18.0 through 30.0.0. The vulnerability could potentially allow an attacker to manipulate a pac4j session cookie. It's important to note that since the druid-pac4j extension is optional and disabled by default, Druid installations not using this extension are not affected by this vulnerability (Apache Advisory, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating that it is network-accessible, requires low attack complexity, needs no privileges or user interaction, and can result in low impact to integrity (NVD).

While the exact impact potential is limited, the vulnerability could allow attackers to manipulate pac4j session cookies. However, according to the advisory, there are currently no known methods to meaningfully exploit this flaw (OSS Security).

Users are recommended to upgrade to Apache Druid version 30.0.1 or higher, which contains the fix for this vulnerability. Additionally, as a precautionary measure, it is advised to ensure a strong druid.auth.pac4j.cookiePassphrase is configured (Apache Advisory).