{"action":"Upgrade org.apache.hive:hive-llap-common to 4.0.0 or later.","affected":[{"fixed":"4.0.0","introduced":"0"}],"component":"org.apache.hive:hive-llap-common","cve_ids":["CVE-2024-23953"],"ecosystem":"Maven","epss":0.01426,"exploited":false,"fixed_versions":["4.0.0"],"ghsa_id":"GHSA-p953-3j66-hg45","id":"tcs_01M5N972TK91N0FJGQSM5YRBT6","modified_at":"2025-01-28T21:27:09.236875Z","published_at":"2025-01-28T09:32:34Z","references":["https://osv.dev/vulnerability/GHSA-p953-3j66-hg45","https://nvd.nist.gov/vuln/detail/CVE-2024-23953","https://github.com/apache/hive/commit/b418e3c9f479ba8e7d31e6470306111002ffa809","https://blog.gypsyengineer.com/en/security/preventing-timing-attacks-with-codeql.html","https://cqr.company/web-vulnerabilities/timing-attacks","https://github.com/apache/hive","https://issues.apache.org/jira/browse/HIVE-28030","https://lists.apache.org/thread/0nloywj49nbtlc6l3c6363qvq7o1ztb7","http://www.openwall.com/lists/oss-security/2025/01/28/3"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-p953-3j66-hg45","url":"https://osv.dev/vulnerability/GHSA-p953-3j66-hg45"}],"summary":"Apache Hive vulnerable to Observable Timing Discrepancy and Authentication Bypass by Spoofing"}