CVE-2024-26307: Apache Doris: Possible race condition

Description

Possible race condition vulnerability in Apache Doris. Some of code using `chmod()` method. This method run the risk of someone renaming the file out from under user and chmodding the wrong file. This could theoretically happen, but the impact would be minimal. This issue affects Apache Doris: before 1.2.8, before 2.0.4. Users are recommended to upgrade to version 2.0.4, which fixes the issue.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack vector

Local

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

Low

Integrity

Low

Availability

Low

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.2% · higher than 13% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

AD

Apache Doris · Apache Software Foundation

before 1.2.8; before 2.0.4 · source: vendor

DO

Doris · Apache

before 1.2.8; 2.0.0 before 2.0.4 · source: NVD, CISA