PT-2024-2471 · Apache · Apache Doris

Mingyu Chen · Published 2024-03-21 · Updated 2025-06-17 · CVE-2024-26307

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Apache Doris versions prior to 1.2.8 Apache Doris versions prior to 2.0.4

Description The issue is related to a possible race condition vulnerability in Apache Doris, where some code uses the chmod() method. This method poses a risk of someone renaming a file out from under the user and chmodding the wrong file. The impact of this issue is considered minimal.

Recommendations For Apache Doris versions prior to 1.2.8, upgrade to version 2.0.4 or later, which fixes the issue. For Apache Doris versions prior to 2.0.4, upgrade to version 2.0.4 or later, which fixes the issue. As a temporary workaround, consider restricting access to the chmod() method until a patch is available.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

BDU:2024-02449

CVE-2024-26307

Affected Products

Apache Doris

References · 13

• https://lists.apache.org/thread/5shhw8x8m271hd2wfwzqzwgf36pmc4pl · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-26307 · Security Note
• https://bdu.fstec.ru/vul/2024-02449 · Security Note
• https://osv.dev/vulnerability/CVE-2024-26307 · Vendor Advisory
• https://doris.apache.org · Note
• https://twitter.com/fletch_ai/status/1771705246705733851 · Twitter Post
• https://twitter.com/CVEnew/status/1770750283657728103 · Twitter Post
• http://openwall.com/lists/oss-security/2024/03/21/2 · Note
• https://twitter.com/RedPacketSec/status/1771116644586209425 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1770791726635946340 · Twitter Post
• https://t.me/cvenotify/74321 · Telegram Post
• https://t.me/cvenotify/125925 · Telegram Post
• https://twitter.com/oss_security/status/1770853902792987015 · Twitter Post