CVE-2020-1926
Medium
Description
Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks. This could allow recovery of another users cookie signature. The issue was addressed in Apache Hive 2.3.8
SeverityMedium
CVSS5.9
Exploit probability—
Product
Apache Hive
PublishedMar 16, 2021
First seenMar 16, 2021
Weakness typeCWE-208CWE-208
How to fix
Update
- apache hive2.3.8 or later
- org.apache.hive:hive2.3.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache hive | v < 2.3.8 | 2.3.8 |
| org.apache.hive:hiveMaven | v < 2.3.8 | 2.3.8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.