GHSA-54g4-5cf6-hjp3
Apache Hive Information Exposure and Observable Timing Discrepancy
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.apache.hive:hive | < 2.3.8 | 2.3.8 |
Details
As written in the advisory (Markdown source, shown as plain text).
Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks. This could allow recovery of another users cookie signature. The issue was addressed in Apache Hive 2.3.8
References
External links from the advisory. They lead to third-party sites.