CVE-2024-26307 Apache Doris: Possible race condition
A race condition in Apache Doris allows attackers to modify permissions of unintended files by renaming them during chmod operations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-26307?
CVE-2024-26307 is a medium-severity vulnerability in Apache Doris, published on 21 Mar 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Possible race condition vulnerability in Apache Doris. Some of code using `chmod()` method. This method run the risk of someone renaming the file out from under user and chmodding the wrong file. This could theoretically happen, but the impact would be minimal. This issue affects Apache Doris: before 1.2.8, before 2.0.4.
Users are recommended to upgrade to version 2.0.4, which fixes the issue.
Weakness: CWE-362
Which versions are affected by CVE-2024-26307?
It affects 1 product.
Products include Apache Doris.
How do I fix CVE-2024-26307?
No fix has been published for CVE-2024-26307 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-26307 being exploited?
There is no known exploitation of CVE-2024-26307 in the wild and no public exploit code.
Other vulnerabilities in Apache Doris
- CVE-2024-27438 Apache Doris: Downloading arbitrary remote jar files resulting in remote command execution
- CVE-2023-41313 Apache Doris: Timing Attack weakness
- CVE-2026-58319 Apache Doris: Improper Authentication in Frontend HTTP API
- CVE-2023-41314 Apache Doris: Missing API authentication allowed DoS
- CVE-2022-23942 Apache Doris hardcoded cryptography initialization
Sources
Also known as GHSA-57pr-424c-2xfr.