title: Apache Doris hardcoded cryptography initialization
description: Apache Doris, prior to 1.0.0, used a hardcoded key and IV to initialize the cipher used for ldap password, which may lead to information disclosure.
problem types: CWE-798 Use of Hard-coded Credentials
affected:
{
product: Apache Doris(Incubating)
vendor: Apache Software Foundation
versions:
status: affected, version: 0.15.0
}
metrics:
other: [
content: {'other': 'moderate'}
type: unknown
]
workarounds: Upgrade to 1.0.0 or higher will resolve this problem.