← Back to CVEs

CVE-2024-26307

MEDIUM

5.3

Description

Possible race condition vulnerability in Apache Doris. Some of code using `chmod()` method. This method run the risk of someone renaming the file out from under user and chmodding the wrong file. This could theoretically happen, but the impact would be minimal. This issue affects Apache Doris: before 1.2.8, before 2.0.4. Users are recommended to upgrade to version 2.0.4, which fixes the issue.

CVE Details

CVSS v3.1 Score5.3

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack VectorLOCAL

ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

Published3/21/2024

Last Modified6/17/2025

Sourcenvd

Honeypot Sightings0

Affected Products

apache:doris

Weaknesses (CWE)

CWE-362

References

http://www.openwall.com/lists/oss-security/2024/03/21/2(security@apache.org)

https://lists.apache.org/thread/5shhw8x8m271hd2wfwzqzwgf36pmc4pl(security@apache.org)

http://www.openwall.com/lists/oss-security/2024/03/21/2(af854a3a-2127-422b-91ae-364da2661108)

https://lists.apache.org/thread/5shhw8x8m271hd2wfwzqzwgf36pmc4pl(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.