Description
Apache Doris, prior to 1.0.0, used a hardcoded key and IV to initialize the cipher used for ldap password, which may lead to information disclosure.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Doris(Incubating) | 0.15.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | pydoris | < 1.0.0 | 1.0.0 | GHSA-98j2-hfxp-8h8r |
References
- https://lists.apache.org/thread/com2dyzp3bn2rdrotry90q2zzord4tvt
- [oss-security] 20220426 CVE-2022-23942: Apache Doris(incubating) hardcoded cryptography initialization mailing-list
- [oss-security] 20220426 [morningman@....com: CVE-2022-23942: Apache Doris(incubating) hardcoded cryptography initialization] mailing-list