Description

Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks. This could allow recovery of another users cookie signature. The issue was addressed in Apache Hive 2.3.8

Remediation

References

https://lists.apache.org/thread.html/rd186eedff68102ba1e68059a808101c5aa587e11542c7dcd26e7b9d7%40%3Cuser.hive.apache.org%3E

https://issues.apache.org/jira/browse/HIVE-22708

Related Vulnerabilities

CVE-2022-44729 Vulnerability in maven package org.apache.xmlgraphics:batik-transcoder

CVE-2023-42795 Vulnerability in maven package org.apache.tomcat:tomcat

CVE-2022-24999 Vulnerability in maven package org.webjars:qs

CVE-2023-31062 Vulnerability in maven package org.apache.inlong:manager-dao

CVE-2021-21266 Vulnerability in maven package org.openhab.addons.bundles:org.openhab.binding.yamahareceiver

Severity

Medium

Classification

CWE-203 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Mailing List Patch Vendor Advisory Issue Tracking