Lucene search

ApacheCVE-2023-41313

HistoryMar 12, 2024 - 11:15 a.m.

CVE-2023-41313

2024-03-1211:15:46

CWE-208

apache

web.nvd.nist.gov

apache doris

authentication

timing attacks

cve-2023-41313

security vulnerability

upgrade

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.9

Confidence

Low

EPSS

Percentile

9.0%

JSON

The authentication method in Apache Doris versions before 2.0.0 was vulnerable to timing attacks.
Users are recommended to upgrade to version 2.0.0 + or 1.2.8, which fixes this issue.

Affected configurations

Vulners

Vulnrichment

Node

apachedorisRange≤1.2.8

VendorProductVersionCPE
apachedoris*cpe:2.3:a:apache:doris:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	doris	*	cpe:2.3:a:apache:doris::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Doris",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "1.2.8",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

References

www.openwall.com/lists/oss-security/2024/03/10/2

lists.apache.org/thread/jqczy3vxzs6q6rz9o0626j5nks9fnv95

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.9

Confidence

Low

EPSS

Percentile

9.0%

JSON

Related for CVE-2023-41313