{"action":"Upgrade org.apache.hive:hive-service to 4.0.0 or later.","affected":[{"fixed":"4.0.0","introduced":"1.2.0"}],"component":"org.apache.hive:hive-service","cve_ids":["CVE-2024-23945"],"ecosystem":"Maven","epss":0.0155,"exploited":false,"fixed_versions":["4.0.0"],"ghsa_id":"GHSA-77pm-w3hx-f8mj","id":"tcs_01M5N8HSYGEX25HV5SB8E7NGKK","modified_at":"2024-12-26T20:28:22.012485Z","published_at":"2024-12-23T18:30:47Z","references":["https://osv.dev/vulnerability/GHSA-77pm-w3hx-f8mj","https://nvd.nist.gov/vuln/detail/CVE-2024-23945","https://github.com/apache/hive/commit/7638cb1a3b07713cc490aa2909a37037f89e08b4","https://github.com/apache/spark/commit/cf59b1f51c16301f689b4e0f17ba4dbd140e1b19","https://github.com/apache/hive","https://github.com/apache/spark","https://issues.apache.org/jira/browse/HIVE-9710","https://issues.apache.org/jira/browse/SPARK-14987","https://lists.apache.org/thread/59r4mv7glrxpwkkdjvjbdljfpx3f5zzc","https://lists.apache.org/thread/5o2ljnzrv8zvhjw9vy7b4rwjpc32hgfc","http://www.openwall.com/lists/oss-security/2024/12/23/2"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-77pm-w3hx-f8mj","url":"https://osv.dev/vulnerability/GHSA-77pm-w3hx-f8mj"}],"summary":"Apache Hive and Spark: CookieSigner exposes the correct signature when message verification fails"}