CVE-2024-23945mediumCWE-209

CVE-2024-23945: falha de média gravidade em Apache Hive

Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification fails

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Apache Hive+ Monitorar Apache Spark

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.9epss 1.6%
Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s service component accidentally exposes the signed cookie to the end user when there is a mismatch in signature between the current and expected cookie. Exposing the correct cookie signature can lead to further exploitation. The vulnerable CookieSigner logic was introduced in Apache Hive by HIVE-9710 (1.2.0) and in Apache Spark by SPARK-14987 (2.0.0). The affected components are the following: * org.apache.hive:hive-service * org.apache.spark:spark-hive-thriftserver_2.11 * org.apache.spark:spark-hive-thriftserver_2.12
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Produtos afetados
Apache Software Foundation · Apache HiveApache Software Foundation · Apache Spark
CVEs relacionadas — Apache Hive

No mesmo produto, das mais perigosas para as menos.

CVE-2022-33891HIGHApache Spark shell command injection vulnerability via Spark UIEPSS 93.2%KEVCVE-2023-32007HIGHApache Spark: Shell command injection via Spark UIEPSS 76.0%CVE-2018-11770—CVE-2018-11770EPSS 66.1%CVE-2020-9480—CVE-2020-9480EPSS 29.4%CVE-2018-17190—CVE-2018-17190EPSS 8.8%CVE-2018-11804—CVE-2018-11804EPSS 5.7%