Description

Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks. This could allow recovery of another users cookie signature. The issue was addressed in Apache Hive 2.3.8

Remediation

References

https://issues.apache.org/jira/browse/HIVE-22708

https://lists.apache.org/thread.html/rd186eedff68102ba1e68059a808101c5aa587e11542c7dcd26e7b9d7%40%3Cuser.hive.apache.org%3E

Related Vulnerabilities

CVE-2022-31830 Vulnerability in npm package kityminder

CVE-2016-4999 Vulnerability in maven package org.dashbuilder:dashbuilder-dataset-sql

CVE-2023-3894 Vulnerability in maven package com.fasterxml.jackson.dataformat:jackson-dataformat-properties

CVE-2022-1295 Vulnerability in maven package org.webjars.bowergithub.alvarotrigo:fullpage.js

CVE-2023-24455 Vulnerability in maven package io.jenkins.plugins:visualexpert

Severity

Medium

Classification

CWE-203 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Issue Tracking Patch Vendor Advisory Mailing List