PT-2023-9835 · Apache · Apache Spark+1

Hamza Tahmi + 1 · Published 2023-10-17 · Updated 2025-07-14 · CVE-2024-23945

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Hive versions 1.2.0 and later Apache Spark versions 2.0.0 and later

Description The issue is related to the exposure of digital signatures in cookie data, which can lead to security vulnerabilities and exploitation. The vulnerable CookieSigner logic was introduced in Apache Hive and Apache Spark, allowing malicious actors to modify cookie values. The affected components include org.apache.hive:hive-service, org.apache.spark:spark-hive-thriftserver 2.11, and org.apache.spark:spark-hive-thriftserver 2.12. Exposing the correct cookie signature can lead to further exploitation.

Recommendations For Apache Hive version 1.2.0 and later, update to a version that fixes the vulnerable CookieSigner logic. For Apache Spark version 2.0.0 and later, update to a version that fixes the vulnerable CookieSigner logic. As a temporary workaround, consider disabling the CookieSigner function until a patch is available. Restrict access to the affected components, including org.apache.hive:hive-service, org.apache.spark:spark-hive-thriftserver 2.11, and org.apache.spark:spark-hive-thriftserver 2.12, to minimize the risk of exploitation.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

BDU:2025-00249

CVE-2024-23945

GHSA-77PM-W3HX-F8MJ

OESA-2025-1039

Affected Products

Apache Hive

Apache Spark

References · 32

• https://github.com/apache/spark/commit/cf59b1f51c16301f689b4e0f17ba4dbd140e1b19 · Patch
• https://github.com/apache/hive/commit/7638cb1a3b07713cc490aa2909a37037f89e08b4 · Patch
• https://issues.apache.org/jira/browse/SPARK-14987 · Vendor Advisory
• https://issues.apache.org/jira/browse/HIVE-9710 · Vendor Advisory
• https://lists.apache.org/thread/59r4mv7glrxpwkkdjvjbdljfpx3f5zzc · Vendor Advisory
• https://lists.apache.org/thread/5o2ljnzrv8zvhjw9vy7b4rwjpc32hgfc · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1039 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-77pm-w3hx-f8mj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-23945 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-00249 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-23945 · Security Note
• https://github.com/apache/spark · Note
• https://github.com/apache/hive · Note
• https://github.com/apache/hive/blob/master/service/src/java/org/apache/hive/service/CookieSigner.java · Note
• https://twitter.com/CCBalert/status/1873754458393338198 · Twitter Post