CVE-2024-23953

A timing discrepancy vulnerability exists in the LlapSignerImpl component of Apache Hive (CWE-208). The software uses Arrays.equals() to compare message signatures, which returns false as soon as a byte mismatch is detected. This allows an authorized user to forge a valid signature for an arbitra...