PT-2021-10311 · Apache · Apache Hive

Published 2021-03-16 · Updated 2022-08-05 · CVE-2020-1926

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Apache Hive versions prior to 2.3.8

Description: The issue is related to Apache Hive's cookie signature verification, which used a non-constant time comparison. This comparison is known to be vulnerable to timing attacks, potentially allowing the recovery of another user's cookie signature.

Recommendations: For versions prior to 2.3.8, update to Apache Hive 2.3.8 to address the issue. As a temporary workaround, consider restricting access to sensitive operations that rely on cookie signature verification until the update is applied.

Fix

Information Disclosure

Side Channel Attack

Weakness Enumeration

CWE-208

CWE-200

CWE-203

Related Identifiers

CVE-2020-1926

GHSA-54G4-5CF6-HJP3

Affected Products

Apache Hive

References · 7

• https://issues.apache.org/jira/browse/HIVE-22708 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-54g4-5cf6-hjp3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1926 · Security Note
• https://lists.apache.org/thread.html/rd186eedff68102ba1e68059a808101c5aa587e11542c7dcd26e7b9d7%40%3Cuser.hive.apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-1926 · Vendor Advisory
• https://t.me/cvenotify/11437 · Telegram Post
• https://t.me/cibsecurity/24945 · Telegram Post