CVE-2020-1926: Apache Hive Information Exposure and Observable Timing Discrepancy
Summary
CVE-2020-1926: Apache Hive Information Exposure and Observable Timing Discrepancy. Affects org.apache.hive:hive versions < 2.3.8. Fixed in 2.3.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Hive is a data warehouse infrastructure built on top of Apache Hadoop for providing data summarization, query, and analysis. It allows users to query and manage large datasets stored in distributed storage. The vulnerability in Apache Hive involves the cookie signature verification process, which did not use a constant time comparison. This vulnerability could potentially allow an attacker to recover another user's cookie signature, leading to unauthorized access to sensitive information. The issue was addressed in Apache Hive version 2.3.8.
Vulnerability Detail
The vulnerability in Apache Hive arises from the non-constant time comparison used in the cookie signature verification process. This type of comparison is known to be vulnerable to timing attacks. By exploiting the timing discrepancies, an attacker could potentially recover another user's cookie signature. This could lead to unauthorized access to the victim's account and sensitive information. The vulnerability has a CVSS score of 5.9, indicating a moderate severity level.
How To Fix
Minimum fixed version
2.3.8
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to Apache Hive version 2.3.8 or later.
Conclusion
The vulnerability in Apache Hive involving the non-constant time comparison in the cookie signature verification process has the potential to allow unauthorized access to sensitive information. It is crucial to upgrade to Apache Hive version 2.3.8 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.hive:hive →
FAQ
Apache Hive is a data warehouse infrastructure built on top of Apache Hadoop for providing data summarization, query, and analysis.
This vulnerability could allow an attacker to recover another user's cookie signature, potentially leading to unauthorized access to sensitive information.
A timing attack is a type of side-channel attack that exploits variations in the time taken to perform certain operations to gain information about secret values.
The vulnerability has a CVSS score of 5.9, indicating a moderate severity level.
To fix this vulnerability, it is recommended to upgrade to Apache Hive version 2.3.8 or later.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.hive:hive.
