CVE-2022-23942 Apache Doris hardcoded cryptography initialization
Attackers can decrypt LDAP passwords due to hardcoded cryptographic keys in Apache Doris, leading to information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-23942?
CVE-2022-23942 is a high-severity vulnerability in Apache Doris(Incubating), published on 26 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apache Doris, prior to 1.0.0, used a hardcoded key and IV to initialize the cipher used for ldap password, which may lead to information disclosure.
Weakness: CWE-798
Which versions are affected by CVE-2022-23942?
3 open source packages ship an affected version, including pydoris. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pydoris PyPI | All versions | 1.0.0 |
pydoris PyPI | All versions | 1.0.0 |
pydoris PyPI | All versions | 1.0.0 |
Products include Apache Doris.
How do I fix CVE-2022-23942?
Upgrade pydoris to 1.0.0 or later.
Is CVE-2022-23942 being exploited?
There is no known exploitation of CVE-2022-23942 in the wild and no public exploit code.
Other vulnerabilities in Apache Doris(Incubating)
- CVE-2024-27438 Apache Doris: Downloading arbitrary remote jar files resulting in remote command execution
- CVE-2023-41313 Apache Doris: Timing Attack weakness
- CVE-2026-58319 Apache Doris: Improper Authentication in Frontend HTTP API
- CVE-2023-41314 Apache Doris: Missing API authentication allowed DoS
- CVE-2024-48019 Apache Doris: allows admin users to read arbitrary files through the REST API
Sources
Also known as GHSA-98j2-hfxp-8h8r, PYSEC-2022-43150.