PT-2025-2366 · Apache · Apache Hive

Andrea Cosentino · Published 2025-01-28 · Updated 2025-02-01 · CVE-2024-23953

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Apache Hive versions prior to 4.0.0

Description The issue arises from the use of Arrays.equals() in LlapSignerImpl to compare message signatures, allowing an attacker to forge a valid signature for an arbitrary message byte by byte. This can occur when an application does not use a constant-time algorithm for validating a signature. The Arrays.equals() method returns false as soon as it encounters different bytes in the input, making the comparison time dependent on the array contents. This could enable malicious users to submit splits or work with selected signatures to LLAP without running as a privileged user, potentially leading to a DDoS attack. The attacker must be an authorized user of the product to perform this attack.

Recommendations Apache Hive versions prior to 4.0.0: Upgrade to version 4.0.0, which fixes this issue.

Exploit

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-208

CWE-290

Related Identifiers

BDU:2025-05249

CVE-2024-23953

GHSA-P953-3J66-HG45

Affected Products

Apache Hive

References · 22

• 🔥 https://blog.gypsyengineer.com/en/security/preventing-timing-attacks-with-codeql.html · Exploit
• https://github.com/apache/hive/commit/b418e3c9f479ba8e7d31e6470306111002ffa809 · Patch
• https://lists.apache.org/thread/0nloywj49nbtlc6l3c6363qvq7o1ztb7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23953 · Security Note
• https://issues.apache.org/jira/browse/HIVE-28030 · Patch
• https://osv.dev/vulnerability/CVE-2024-23953 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-05249 · Security Note
• https://osv.dev/vulnerability/GHSA-p953-3j66-hg45 · Vendor Advisory
• https://github.com/apache/hive · Note
• https://twitter.com/fridaysecurity/status/1885153848194367782 · Twitter Post
• https://twitter.com/fletch_ai/status/1885629251585802722 · Twitter Post
• https://t.me/pentestingnews/55925 · Telegram Post
• https://twitter.com/CVEnew/status/1884183308030079103 · Twitter Post
• https://cqr.company/web-vulnerabilities/timing-attacks · Note
• https://t.me/cvenotify/108849 · Telegram Post