CVE-2024-23945 Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification fails

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.hive:hive-service",
    "product": "Apache Hive",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "4.0.0",
        "status": "affected",
        "version": "1.2.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.spark:spark-hive-thriftserver_2.11",
    "product": "Apache Spark",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "3.0.0",
        "status": "affected",
        "version": "2.0.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.spark:spark-hive-thriftserver_2.12",
    "product": "Apache Spark",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "3.3.4",
        "status": "affected",
        "version": "3.0.0",
        "versionType": "semver"
      },
      {
        "lessThan": "3.4.2",
        "status": "affected",
        "version": "3.4.0",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "3.5.0",
        "versionType": "semver"
      }
    ]
  }
]