GHSA-54g4-5cf6-hjp3MediumCVSS 5.9

Apache Hive Information Exposure and Observable Timing Discrepancy

Published
February 9, 2022
Last Modified
January 30, 2023

🔗 CVE IDs covered (1)

CVE-2020-1926 →

📋 Description

Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks. This could allow recovery of another users cookie signature. The issue was addressed in Apache Hive 2.3.8

🎯 Affected products1

  • maven/org.apache.hive:hive:< 2.3.8

🔗 References (4)