com.pingcap.tispark:spark-wrapper-spark-2.4 (>=2.4.4-scala_2.12 <=2.4.4-scala_2.12-RC2), com.pingcap.tispark:spark-wrapper-spark-3.0 (>=2.5.0 <=2.5.3) +21 more potentially affected by CVE-2024-23945 via org.apache.spark:spark-hive-thriftserver_2.12 (>=2.4.8 <=3.3.1)

org.apache.spark:spark-hive-thriftserver2.12 MAVEN version =2.4.8, =2.4.4-scala2.12, =2.5.0, =3.0.1, =2.5.0, =3.0.1, =3.0.1, =3.1.0, =2.4.4-scala2.12, =2.5.1, =3.0.1, =2.5.1, =3.0.1, =3.0.1, =3.1.0, =2.4.4-scala2.12, =3.2.3 and more Source cves: CVE-2024-23945 Source advisory:...

ch.ninecode.cim:CIMReader (>=2.11-2.1.1-2.2.0 <=2.11-2.3.1-3.4.0), com.hindog.grid:grid-executor-examples_2.11 (>=2.0.2 <=2.0.7) +29 more potentially affected by CVE-2024-23945 via org.apache.spark:spark-hive-thriftserver_2.11 (>=2.1.0 <=2.4.8)

org.apache.spark:spark-hive-thriftserver2.11 MAVEN version =2.1.0, =2.11-2.1.1-2.2.0, =2.0.2, =1.0, =2.2.0, =2.2.0, =2.2.0, =1.0, =2.3.0, =1.0, =1.100.100-SNAPSHOT-2.3.0, =1.4.0, =2.0.0, =1.6.0, =1.1.0, =1.5.1 and more Source cves: CVE-2024-23945 Source advisory: OSV:GHSA-77PM-W3HX-F8MJ...

Information Disclosure

org.apache.spark:spark-hive-thriftserver2.12 is vulnerable to information disclosure. The vulnerability allows someone to decrypt plaintext traffic offline because the library uses a bespoke mutual authentication protocol that allows for full encryption key recovery resulting in disclosure of...