Apache Doris hardcoded key and IV

高危 7.5CVE-2022-23942 · GHSA-98j2-hfxp-8h8r · PYSEC-2022-43150 · Published 26/04/2022 · updated 17/06/2026

要点

Package	Affected versions	Patched versions
pydoris PyPI	`< 1.0.0`	`1.0.0`
doris apache	`< 1.0.0`	`1.0.0`

Apache Doris, prior to 1.0.0, used a hardcoded key and IV to initialize the cipher used for ldap password, which may lead to information disclosure.

NVD description

Apache Doris, prior to 1.0.0, used a hardcoded key and IV to initialize the cipher used for ldap password, which may lead to information disclosure.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.