Apache Doris hardcoded cryptography initialization
Priority LOW 39CWE-798Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-798.
Summary
Apache Doris, prior to 1.0.0, used a hardcoded key and IV to initialize the cipher used for ldap password, which may lead to information disclosure.
Why it matters now
EPSS 0.0336 88th percentileScored 2026-11-07
Fix Fixed pydoris (PyPI): 1.0.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Doris(Incubating) | 0.15.0 | — | No fix listed | CNA |
| — | pydoris (PyPI) | before 1.0.0 | 1.0.0 | Patch available | GHSA-98j2-hfxp-8h8r |
- Apache Doris(Incubating) VendorApache Affected 0.15.0 Fixed in — No fix listed CNA
- pydoris (PyPI) Vendor— Affected before 1.0.0 Fixed in 1.0.0 Patch available GHSA-98j2-hfxp-8h8r
Remediation
- Fix · GHSA-98j2-hfxp-8h8r pydoris (PyPI) Fixed in 1.0.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-23942
- 2026-10-03 Alias added: GHSA-98j2-hfxp-8h8r
References
Advisory 4
- https://lists.apache.org/thread/com2dyzp3bn2rdrotry90q2zzord4tvt
- [oss-security] 20220426 CVE-2022-23942: Apache Doris(incubating) hardcoded cryptography initialization
- [oss-security] 20220426 [[email protected]: CVE-2022-23942: Apache Doris(incubating) hardcoded cryptography initialization]
- https://nvd.nist.gov/vuln/detail/CVE-2022-23942
More Apache Doris vulnerabilities
- TI-2024-18262 Apache Doris: Downloading arbitrary remote jar files resulting in remote command execution CVSS 3.1CRITICAL 9.8
- TI-2023-21914 Apache Doris: Timing Attack weakness CVSS 3.1CRITICAL 9.8
- TI-2026-41999 Apache Doris: Improper Authentication in Frontend HTTP API CVSS 3.1CRITICAL 9.1
- TI-2023-21915 Apache Doris: Missing API authentication allowed DoS CVSS 3.1HIGH 8.2
- TI-2024-32221 Apache Doris: allows admin users to read arbitrary files through the REST API CVSS 3.1MEDIUM 5.4
- TI-2024-17388 Apache Doris: Possible race condition CVSS 3.1MEDIUM 5.3
Sources
- CVE-2022-23942 · CVE Program
- CVE-2022-23942 · NVD
- FIRST EPSS
- GHSA-98j2-hfxp-8h8r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences