← All advisories

High severity7.5NVD Advisory· Published Apr 26, 2022· Updated Jun 17, 2026

CVE-2022-23942

CVE-2022-23942

Description

Apache Doris, prior to 1.0.0, used a hardcoded key and IV to initialize the cipher used for ldap password, which may lead to information disclosure.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
pydorisPyPI	< 1.0.0	1.0.0

Affected products

3

Apache/Doris
cpe:2.3:a:apache:doris:*:*:*:*:*:*:*:*
Range: <1.0.0
ghsa-coords
pkg:pypi/pydoris
Range: < 1.0.0
Apache Software Foundation/Apache Doris(Incubating)v5
Range: 0.15.0

Patches

Vulnerability mechanics

References

6

www.openwall.com/lists/oss-security/2022/04/26/2nvdMailing ListThird Party AdvisoryWEB
www.openwall.com/lists/oss-security/2022/04/26/3nvdMailing ListThird Party AdvisoryWEB
github.com/advisories/GHSA-98j2-hfxp-8h8rghsaADVISORY
lists.apache.org/thread/com2dyzp3bn2rdrotry90q2zzord4tvtnvdMailing ListVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2022-23942ghsaADVISORY
github.com/pypa/advisory-database/tree/main/vulns/pydoris/PYSEC-2022-43150.yamlghsaWEB

News mentions

0

No linked articles in our index yet.