CVE-2023-41313

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The authentication method in Apache Doris versions before 2.0.0 was vulnerable to timing attacks. Users are recommended to upgrade to version 2.0.0 + or 1.2.8, which fixes this issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-208

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Doris	< 1.2.8
apache	doris	< 1.2.8

References

http://www.openwall.com/lists/oss-security/2024/03/10/2Mailing List
https://lists.apache.org/thread/jqczy3vxzs6q6rz9o0626j5nks9fnv95Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/03/10/2Mailing List
https://lists.apache.org/thread/jqczy3vxzs6q6rz9o0626j5nks9fnv95Mailing List, Vendor Advisory

Timeline

Published: Mar 12, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-413148.2The api /api/snapshot and /api/get_log_file would allow unauthenticated access. It could allow a DoS attack or get arbitrary files from FE n CVE-2023-413165.4Tolgee is an open-source localization platform. Due to lack of validation field - Org Name, bad actor can send emails with HTML injected cod CVE-2023-413175.9The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation CVE-2023-413185.4matrix-media-repo is a highly customizable multi-domain media repository for the Matrix chat ecosystem. In affected versions an attacker cou CVE-2023-413197.2Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the CVE-2023-41325.5A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs during device initialization when th CVE-2023-413209.8GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk CVE-2023-413216.5GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk CVE-2023-413228.8GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk CVE-2023-413235.3GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk CVE-2023-413248.8GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk CVE-2023-413256.7OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the