176 matches found
CVE-2024-27438
Download of Code Without Integrity Check vulnerability in Apache Doris. The jdbc driver files used for JDBC catalog is not checked and may resulting in remote command execution. Once the attacker is authorized to create a JDBC catalog, he/she can use arbitrary driver jar file with unchecked code...
CVE-2024-27438
Download of Code Without Integrity Check vulnerability in Apache Doris. The jdbc driver files used for JDBC catalog is not checked and may resulting in remote command execution. Once the attacker is authorized to create a JDBC catalog, he/she can use arbitrary driver jar file with unchecked code...
CVE-2024-26307
Possible race condition vulnerability in Apache Doris. Some of code using chmod method. This method run the risk of someone renaming the file out from under user and chmodding the wrong file. This could theoretically happen, but the impact would be minimal. This issue affects Apache Doris: before...
CVE-2024-26307
Possible race condition vulnerability in Apache Doris. Some of code using chmod method. This method run the risk of someone renaming the file out from under user and chmodding the wrong file. This could theoretically happen, but the impact would be minimal. This issue affects Apache Doris: before...
CVE-2024-27438 Apache Doris: Downloading arbitrary remote jar files resulting in remote command execution
Download of Code Without Integrity Check vulnerability in Apache Doris. The jdbc driver files used for JDBC catalog is not checked and may resulting in remote command execution. Once the attacker is authorized to create a JDBC catalog, he/she can use arbitrary driver jar file with unchecked code...
CVE-2024-27438 Apache Doris: Downloading arbitrary remote jar files resulting in remote command execution
Download of Code Without Integrity Check vulnerability in Apache Doris. The jdbc driver files used for JDBC catalog is not checked and may resulting in remote command execution. Once the attacker is authorized to create a JDBC catalog, he/she can use arbitrary driver jar file with unchecked code...
CVE-2024-27438
Download of Code Without Integrity Check vulnerability in Apache Doris. The jdbc driver files used for JDBC catalog is not checked and may resulting in remote command execution. Once the attacker is authorized to create a JDBC catalog, he/she can use arbitrary driver jar file with unchecked code...
CVE-2024-27438
Apache Doris versions 1.2.0 through 2.0.4 are vulnerable to a Download of Code Without Integrity Check (CWE-494) vulnerability. The root cause is that JDBC driver files used for the JDBC catalog are not checked for integrity. An attacker authorized to create a JDBC catalog can provide an arbitrar...
CVE-2024-26307 Apache Doris: Possible race condition
Possible race condition vulnerability in Apache Doris. Some of code using chmod method. This method run the risk of someone renaming the file out from under user and chmodding the wrong file. This could theoretically happen, but the impact would be minimal. This issue affects Apache Doris: before...
CVE-2024-26307
Apache Doris versions prior to 1.2.8 and 2.0.4 are vulnerable to a race condition within the backend storage and frontend request handlers . The issue stems from the use of the chmod() function, where a lack of synchronization when handling shared resources allows an attacker to rename a file dur...
CVE-2024-26307 Apache Doris: Possible race condition
Possible race condition vulnerability in Apache Doris. Some of code using chmod method. This method run the risk of someone renaming the file out from under user and chmodding the wrong file. This could theoretically happen, but the impact would be minimal. This issue affects Apache Doris: before...
CVE-2024-26307
Possible race condition vulnerability in Apache Doris. Some of code using "chmod" method. This method run the risk of someone renaming the file out from under user and chmodding the wrong file. This could theoretically happen, but the impact would be minimal. This issue affects Apache Doris: befo...
Apache Doris 安全漏洞
Apache Doris is a modern MPP analytic database product of the U.S. Apache Apache Foundation. Can provide sub-second queries and efficient real-time data analysis. Apache Doris has a command execution vulnerability that originates from an unchecked jdbc driver file used by the jdbc directory, whic...
Apache Doris 竞争条件问题漏洞
Apache Doris is a modern MPP analytic database product of the U.S. Apache Apache Foundation. Can provide sub-second queries and efficient real-time data analysis. Apache Doris has a security bypass vulnerability that stems from the use of the chmod function, which can be exploited by an attacker ...
PT-2024-2471 · Apache · Apache Doris
Name of the Vulnerable Software and Affected Versions: Apache Doris versions prior to 1.2.8 Apache Doris versions prior to 2.0.4 Description: The issue is related to a possible race condition vulnerability in Apache Doris, where some code uses the chmod method. This method poses a risk of someone...
PT-2024-2423 · Apache · Apache Doris
Name of the Vulnerable Software and Affected Versions: Apache Doris versions 1.2.0 through 2.0.4 Description: The issue is related to the download of code without integrity check in Apache Doris, which may result in remote command execution. An attacker authorized to create a JDBC catalog can use...
CVE-2024-27438: Download of Code Without Integrity Check
Download of Code Without Integrity Check vulnerability in Apache Doris. The jdbc driver files used for JDBC catalog is not checked and may resulting in remote command execution. Once the attacker is authorized to create a JDBC catalog, he/she can use arbitrary driver jar file with unchecked code...
CVE-2024-26307: Concurrent Execution using Shared Resource with Improper Synchronization
Possible race condition vulnerability in Apache Doris. Some of code using chmod method. This method run the risk of someone renaming the file out from under user and chmodding the wrong file. This could theoretically happen, but the impact would be minimal. This issue affects Apache Doris: before...
Apache Doris Information Disclosure Vulnerability (CNVD-2024-13570)
Apache Doris is a modern MPP analytic database product of the U.S. Apache Apache Foundation. Can provide sub-second queries and efficient real-time data analysis. Apache Doris suffers from an information disclosure vulnerability that can be exploited by an attacker to obtain sensitive information...