CVE-2022-23942: Apache Doris hardcoded key and IV

April 27, 2022 (updated November 22, 2024)

Apache Doris, prior to 1.0.0, used a hardcoded key and IV to initialize the cipher used for ldap password, which may lead to information disclosure.

References

github.com/advisories/GHSA-98j2-hfxp-8h8r
github.com/apache/doris
github.com/pypa/advisory-database/tree/main/vulns/pydoris/PYSEC-2022-43150.yaml
lists.apache.org/thread/com2dyzp3bn2rdrotry90q2zzord4tvt
nvd.nist.gov/vuln/detail/CVE-2022-23942

Code Behaviors & Features

Detect and mitigate CVE-2022-23942 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →