GHSA-54g4-5cf6-hjp3

ghsaUSosv

Apache Hive Information Exposure and Observable Timing Discrepancy

view advisory published 2022-02-09Licence: CC-BY-4.0

Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks. This could allow recovery of another users cookie signature. The issue was addressed in Apache Hive 2.3.8

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-1926US	medium5.9	2.46% (84th)	—	2021-03-16
Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks. This could allow recovery of another users cookie s…

references

External citations — patches, advisories, analysis.

https://issues.apache.org/jira/browse/HIVE-22708WEB
https://lists.apache.org/thread.html/rd186eedff68102ba1e68059a808101c5aa587e11542c7dcd26e7b9d7%40%3Cuser.hive.apache.org%3EWEB
https://nvd.nist.gov/vuln/detail/CVE-2020-1926ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan