Maven/org.apache.hive:hive-service CVE-2024-23945: medium 5.9, EPSS 1.55%

Apache Hive and Spark: CookieSigner exposes the correct signature when message verification fails

Action: Upgrade org.apache.hive:hive-service to 4.0.0 or later.

Affected

Fixed versions

Sources

• osv: GHSA-77pm-w3hx-f8mj
• https://nvd.nist.gov/vuln/detail/CVE-2024-23945
• https://github.com/apache/hive/commit/7638cb1a3b07713cc490aa2909a37037f89e08b4
• https://github.com/apache/spark/commit/cf59b1f51c16301f689b4e0f17ba4dbd140e1b19
• https://github.com/apache/hive
• https://github.com/apache/spark
• https://issues.apache.org/jira/browse/HIVE-9710
• https://issues.apache.org/jira/browse/SPARK-14987
• https://lists.apache.org/thread/59r4mv7glrxpwkkdjvjbdljfpx3f5zzc
• https://lists.apache.org/thread/5o2ljnzrv8zvhjw9vy7b4rwjpc32hgfc
• http://www.openwall.com/lists/oss-security/2024/12/23/2

CVE-2024-23945 · published 2024-12-23T18:30:47Z · modified 2024-12-26T20:28:22.012485Z · JSON