Junglewise Threat Intelligence

CVE-2024-23945: Apache Hive and Spark: CookieSigner exposes the correct signature when message verification fails

CVE-2024-23945 · Severity: low · CVSS 3.1 · Published 2024-12-23

Technologies: org.apache.hive:hive-service (Maven). Vendors: Maven.

Executive brief

Apache Hive and Spark: CookieSigner exposes the correct signature when message verification fails

Affected products

  • Maven org.apache.spark:spark-hive-thriftserver_2.12
  • Maven org.apache.spark:spark-hive-thriftserver_2.11
  • Maven org.apache.hive:hive-service

Related threats