{"action":"Upgrade org.apache.spark:spark-hive-thriftserver_2.12 to 3.4.2 or later.","affected":[{"fixed":"3.4.2","introduced":"0"}],"component":"org.apache.spark:spark-hive-thriftserver_2.12","cve_ids":["CVE-2024-23945"],"ecosystem":"Maven","epss":0.0155,"exploited":false,"fixed_versions":["3.4.2"],"ghsa_id":"GHSA-77pm-w3hx-f8mj","id":"tcs_01M5N8HT88DFSYNGEY75YAT7CS","modified_at":"2024-12-26T20:28:22.012485Z","published_at":"2024-12-23T18:30:47Z","references":["https://osv.dev/vulnerability/GHSA-77pm-w3hx-f8mj","https://nvd.nist.gov/vuln/detail/CVE-2024-23945","https://github.com/apache/hive/commit/7638cb1a3b07713cc490aa2909a37037f89e08b4","https://github.com/apache/spark/commit/cf59b1f51c16301f689b4e0f17ba4dbd140e1b19","https://github.com/apache/hive","https://github.com/apache/spark","https://issues.apache.org/jira/browse/HIVE-9710","https://issues.apache.org/jira/browse/SPARK-14987","https://lists.apache.org/thread/59r4mv7glrxpwkkdjvjbdljfpx3f5zzc","https://lists.apache.org/thread/5o2ljnzrv8zvhjw9vy7b4rwjpc32hgfc","http://www.openwall.com/lists/oss-security/2024/12/23/2"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-77pm-w3hx-f8mj#Maven/org.apache.spark:spark-hive-thriftserver_2.12","url":"https://osv.dev/vulnerability/GHSA-77pm-w3hx-f8mj"}],"summary":"Apache Hive and Spark: CookieSigner exposes the correct signature when message verification fails"}