[prev in list] [next in list] [prev in thread] [next in thread]
List: oss-security
Subject: [oss-security] CVE-2024-27438: Apache Doris: Downloading arbitrary remote jar files resulting in rem
From: Mingyu Chen <morningman () apache ! org>
Date: 2024-03-21 8:45:07
Message-ID: 3ae2a789-d0ff-ad5d-12cd-2815754aac4f () apache ! org
[Download RAW message or body]
Severity: important
Affected versions:
- Apache Doris 1.2.0 through 2.0.4
Description:
Download of Code Without Integrity Check vulnerability in Apache Doris.
The jdbc driver files used for JDBC catalog is not checked and may resulting in remote command \
execution. Once the attacker is authorized to create a JDBC catalog, he/she can use arbitrary \
driver jar file with unchecked code snippet. This code snippet will be run when catalog is \
initializing without any check. This issue affects Apache Doris: from 1.2.0 through 2.0.4.
Users are recommended to upgrade to version 2.0.5 or 2.1.x, which fixes the issue.
References:
https://doris.apache.org
https://www.cve.org/CVERecord?id=CVE-2024-27438
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic