title: Apache Doris: Timing Attack weakness
description: The authentication method in Apache Doris versions before 2.0.0 was vulnerable to timing attacks.
Users are recommended to upgrade to version 2.0.0 + or 1.2.8, which fixes this issue.
problem types: CWE-208: Observable Timing Discrepancy
affected:
{
defaultStatus: unaffected
product: Apache Doris
vendor: Apache Software Foundation
versions:
lessThan: 1.2.8, status: affected, version: 0, versionType: semver
}
metrics:
other: [
content: {'text': 'important'}
type: Textual description of severity
]