CVE-2023-41313

A timing attack (timing attack) consists of analyzing differences in server response time during authentication data verification. An attacker, by precisely measuring response time to successive login attempts, can gradually guess correct values (e.g., password or token) byte by byte. The vulnerable implementation of the authentication method in Apache Doris did not eliminate these time differences, making it susceptible to this type of analysis. The attack can be conducted remotely, without the need to possess prior access or interaction from the user.

Successful exploitation of the vulnerability may allow an attacker to guess authentication credentials and gain unauthorized access to the system, which consequently leads to violation of data confidentiality, integrity, and availability.

Apache Doris should be updated to version 2.0.0 or later, or to version 1.2.8, which contain patches eliminating the vulnerability.

Apache Doris in all versions before 2.0.0