GHSA-54g4-5cf6-hjp3

Source

https://github.com/advisories/GHSA-54g4-5cf6-hjp3

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-54g4-5cf6-hjp3/GHSA-54g4-5cf6-hjp3.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-54g4-5cf6-hjp3

Aliases

CVE-2020-1926

Published

2022-02-09T00:48:54Z

Modified

2023-11-08T04:02:45.499739Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Apache Hive Information Exposure and Observable Timing Discrepancy

Details

Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks. This could allow recovery of another users cookie signature. The issue was addressed in Apache Hive 2.3.8

Database specific

{
    "github_reviewed": true,
    "severity": "MODERATE",
    "github_reviewed_at": "2021-03-31T21:30:08Z",
    "cwe_ids": [
        "CWE-200",
        "CWE-203",
        "CWE-208"
    ],
    "nvd_published_at": "2021-03-16T13:15:00Z"
}

References

Affected packages

Maven / org.apache.hive:hive

Package

Name: org.apache.hive:hive; View open source insights on deps.dev
Purl: pkg:maven/org.apache.hive/hive

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.3.8

Affected versions

0.*

0.13.0

0.13.1

0.14.0

1.*

1.0.0

1.0.1

1.1.0

1.1.1

1.2.0

1.2.1

1.2.2

2.*

2.0.0

2.0.1

2.1.0

2.1.1

2.2.0

2.3.0

2.3.1

2.3.2

2.3.3

2.3.4

2.3.5

2.3.6

2.3.7