VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Mar 21, 2024· Updated Jun 17, 2026

CVE-2024-27438

CVE-2024-27438

Description

Download of Code Without Integrity Check vulnerability in Apache Doris. The jdbc driver files used for JDBC catalog is not checked and may resulting in remote command execution. Once the attacker is authorized to create a JDBC catalog, he/she can use arbitrary driver jar file with unchecked code snippet. This code snippet will be run when catalog is initializing without any check. This issue affects Apache Doris: from 1.2.0 through 2.0.4.

Users are recommended to upgrade to version 2.0.5 or 2.1.x, which fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Apache/Doris2 versions
    cpe:2.3:a:apache:doris:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:apache:doris:*:*:*:*:*:*:*:*range: >=1.2.0,<2.0.5
    • (no CPE)range: 1.2.0-2.0.4
  • Apache Software Foundation/Apache Dorisv5
    Range: 1.2.0

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.