{"id":"CVE-2024-26307","state":"PUBLISHED","title":"Apache Doris: Possible race condition","description":"Possible race condition vulnerability in Apache Doris.\nSome of code using `chmod()` method. This method run the risk of someone renaming the file out from under user and chmodding the wrong file.\nThis could theoretically happen, but the impact would be minimal.\nThis issue affects Apache Doris: before 1.2.8, before 2.0.4.\n\nUsers are recommended to upgrade to version 2.0.4, which fixes the issue.","publishedAt":"2024-03-21T09:38:19.368Z","updatedAt":"2025-02-13T17:41:13.412Z","severity":{"score":5.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","source":"CISA-ADP"},"assigner":"apache","products":["Apache Software Foundation Apache Doris"],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Doris","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.2.8","versionType":"semver"},{"version":"0","status":"affected","lessThan":"2.0.4","versionType":"semver"}]}],"references":["https://lists.apache.org/thread/5shhw8x8m271hd2wfwzqzwgf36pmc4pl","http://www.openwall.com/lists/oss-security/2024/03/21/2"],"weaknesses":["CWE-362"],"ingestedAt":"2026-10-29T20:07:10.607Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/26xxx/CVE-2024-26307.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-26307","state":"PUBLISHED","datePublished":"2024-03-21T09:38:19.368Z","dateUpdated":"2025-02-13T17:41:13.412Z","assignerShortName":"apache","assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateReserved":"2024-02-17T01:50:01.548Z"},"containers":{"cna":{"title":"Apache Doris: Possible race condition","descriptions":[{"lang":"en","value":"Possible race condition vulnerability in Apache Doris.\nSome of code using `chmod()` method. This method run the risk of someone renaming the file out from under user and chmodding the wrong file.\nThis could theoretically happen, but the impact would be minimal.\nThis issue affects Apache Doris: before 1.2.8, before 2.0.4.\n\nUsers are recommended to upgrade to version 2.0.4, which fixes the issue."}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Doris","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.2.8","versionType":"semver"},{"version":"0","status":"affected","lessThan":"2.0.4","versionType":"semver"}]}],"references":[{"url":"https://lists.apache.org/thread/5shhw8x8m271hd2wfwzqzwgf36pmc4pl","tags":["vendor-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/21/2"}],"metrics":[{"other":{"content":{"text":"low"},"type":"Textual description of severity"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-362","description":"CWE-362: Possible race condition","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"apache","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateUpdated":"2024-05-01T17:09:11.430Z"},"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"apache","product":"doris","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"2.0.4","versionType":"custom"}],"cpes":["cpe:2.3:a:apache:doris:-:*:*:*:*:*:*:*"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"id":"CVE-2024-26307","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-05-01T19:25:51.953543Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-04T17:48:28.523Z"}},{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread/5shhw8x8m271hd2wfwzqzwgf36pmc4pl","tags":["vendor-advisory","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/21/2","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T00:07:19.425Z"}}]}}}