Description
The authentication method in Apache Doris versions before 2.0.0 was vulnerable to timing attacks. Users are recommended to upgrade to version 2.0.0 + or 1.2.8, which fixes this issue.
References (2)
Core 2
Core References
Mailing List, Vendor Advisory vendor-advisory
https://lists.apache.org/thread/jqczy3vxzs6q6rz9o0626j5nks9fnv95
Scores
CVSS v3
9.8
EPSS
0.0101
EPSS Percentile
58.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-208
Status
published
Products (1)
apache/doris
< 1.2.8
Published
Mar 12, 2024
Tracked Since
Feb 18, 2026