apache doris vulnerabilities

Latest apache doris CVEs

Newest publication first

1. CVE-2024-26307 Apache Doris: Possible race condition

   Published 2024-03-21

   Medium·CVSS 5.3

   Possible race condition vulnerability in Apache Doris. Some of code using chmod() method. This method run the risk of someone renaming the file out from under user and chmodding the wrong file. This could theoretically happen, but the impact would be minimal. This issue affects A...

2. CVE-2023-41313 Apache Doris: Timing Attack weakness

   Published 2024-03-12

   Critical·CVSS 9.8

   The authentication method in Apache Doris versions before 2.0.0 was vulnerable to timing attacks. Users are recommended to upgrade to version 2.0.0 + or 1.2.8, which fixes this issue.

3. CVE-2022-23942 Apache Doris hardcoded cryptography initialization

   Published 2022-04-26

   High·CVSS 7.5

   Apache Doris, prior to 1.0.0, used a hardcoded key and IV to initialize the cipher used for ldap password, which may lead to information disclosure.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.