CVE-2024-27438

Apache Doris versions 1.2.0 through 2.0.4 are vulnerable to a Download of Code Without Integrity Check (CWE-494) vulnerability. The root cause is that JDBC driver files used for the JDBC catalog are not checked for integrity. An attacker authorized to create a JDBC catalog can provide an arbitrar...

CVE-2024-26307

Apache Doris versions prior to 1.2.8 and 2.0.4 are vulnerable to a race condition within the backend storage and frontend request handlers . The issue stems from the use of the chmod() function, where a lack of synchronization when handling shared resources allows an attacker to rename a file dur...

CVE-2024-26307 Apache Doris: Possible race condition

Possible race condition vulnerability in Apache Doris. Some of code using chmod method. This method run the risk of someone renaming the file out from under user and chmodding the wrong file. This could theoretically happen, but the impact would be minimal. This issue affects Apache Doris: before...

CVE-2024-26307 Apache Doris: Possible race condition

Possible race condition vulnerability in Apache Doris. Some of code using chmod method. This method run the risk of someone renaming the file out from under user and chmodding the wrong file. This could theoretically happen, but the impact would be minimal. This issue affects Apache Doris: before...

CVE-2024-27438: Download of Code Without Integrity Check

Download of Code Without Integrity Check vulnerability in Apache Doris. The jdbc driver files used for JDBC catalog is not checked and may resulting in remote command execution. Once the attacker is authorized to create a JDBC catalog, he/she can use arbitrary driver jar file with unchecked code...

Apache Doris 安全漏洞

Apache Doris is a modern MPP analytic database product of the U.S. Apache Apache Foundation. Can provide sub-second queries and efficient real-time data analysis. Apache Doris has a command execution vulnerability that originates from an unchecked jdbc driver file used by the jdbc directory, whic...

Apache Doris 竞争条件问题漏洞

Apache Doris is a modern MPP analytic database product of the U.S. Apache Apache Foundation. Can provide sub-second queries and efficient real-time data analysis. Apache Doris has a security bypass vulnerability that stems from the use of the chmod function, which can be exploited by an attacker ...

PT-2024-2471 · Apache · Apache Doris

Name of the Vulnerable Software and Affected Versions: Apache Doris versions prior to 1.2.8 Apache Doris versions prior to 2.0.4 Description: The issue is related to a possible race condition vulnerability in Apache Doris, where some code uses the chmod method. This method poses a risk of someone...

CVE-2024-26307: Concurrent Execution using Shared Resource with Improper Synchronization

Possible race condition vulnerability in Apache Doris. Some of code using chmod method. This method run the risk of someone renaming the file out from under user and chmodding the wrong file. This could theoretically happen, but the impact would be minimal. This issue affects Apache Doris: before...

PT-2024-2423 · Apache · Apache Doris

Name of the Vulnerable Software and Affected Versions: Apache Doris versions 1.2.0 through 2.0.4 Description: The issue is related to the download of code without integrity check in Apache Doris, which may result in remote command execution. An attacker authorized to create a JDBC catalog can use...

Apache Doris Information Disclosure Vulnerability (CNVD-2024-13570)

Apache Doris is a modern MPP analytic database product of the U.S. Apache Apache Foundation. Can provide sub-second queries and efficient real-time data analysis. Apache Doris suffers from an information disclosure vulnerability that can be exploited by an attacker to obtain sensitive information...

CVE-2023-41313

The authentication method in Apache Doris versions before 2.0.0 was vulnerable to timing attacks. Users are recommended to upgrade to version 2.0.0 + or 1.2.8, which fixes this issue...

CVE-2023-41313

The authentication method in Apache Doris versions before 2.0.0 was vulnerable to timing attacks. Users are recommended to upgrade to version 2.0.0 + or 1.2.8, which fixes this issue...

Authentication flaw

The authentication method in Apache Doris versions before 2.0.0 was vulnerable to timing attacks. Users are recommended to upgrade to version 2.0.0 + or 1.2.8, which fixes this issue...

CVE-2023-41313 Apache Doris: Timing Attack weakness

The authentication method in Apache Doris versions before 2.0.0 was vulnerable to timing attacks. Users are recommended to upgrade to version 2.0.0 + or 1.2.8, which fixes this issue...

CVE-2023-41313 Apache Doris: Timing Attack weakness

The authentication method in Apache Doris versions before 2.0.0 was vulnerable to timing attacks. Users are recommended to upgrade to version 2.0.0 + or 1.2.8, which fixes this issue...

CVE-2023-41313

The authentication method in Apache Doris versions prior to 2.0.0 is vulnerable to timing attacks (CWE-208). An attacker could potentially exploit this discrepancy to gain unauthorized access or information. To mitigate this risk, users are recommended to upgrade to version 2.0.0+ or 1.2.8 . Whil...

CVE-2023-41313: Observable Timing Discrepancy

The authentication method in Apache Doris versions before 2.0.0 was vulnerable to timing attacks. Users are recommended to upgrade to version 2.0.0 + or 1.2.8, which fixes this issue...

Apache Doris 安全漏洞

Apache Doris is a modern MPP analytic database product of the U.S. Apache Apache Foundation. Can provide sub-second queries and efficient real-time data analysis. Apache Doris suffers from an information disclosure vulnerability that can be exploited by an attacker to obtain sensitive information...

PT-2024-12938 · Apache · Apache Doris

Name of the Vulnerable Software and Affected Versions: Apache Doris versions prior to 2.0.0 Apache Doris version 1.2.8 and earlier Description: The authentication method in Apache Doris was vulnerable to timing attacks. This issue allows attackers to potentially exploit the system. Users are...