CVE-2020-1926 Timing attack in Cookie signature verification

2021-03-1613:00:16

CWE-208

apache

www.cve.org

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.4%

JSON

Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks. This could allow recovery of another users cookie signature. The issue was addressed in Apache Hive 2.3.8

CNA Affected

[
  {
    "product": "Apache Hive",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "2.3.8",
        "status": "affected",
        "version": "Apache Hive",
        "versionType": "custom"
      }
    ]
  }
]