Improper Authentication

Overview org.apache.hive:hive-service is a package for reading, writing, and managing large datasets residing in distributed storage using SQL. Affected versions of this package are vulnerable to Improper Authentication through the doSamlAuth process in...

CVE-2024-23945

Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s servic...

OESA-2025-1039 spark security update

Apache Spark achieves high performance for both batch and streaming data, using a state-of-the-art DAG scheduler, a query optimizer, and a physical execution engine. Security Fixes: Signing cookies is an application security feature that adds a digital signature to cookie data to verify its...

GHSA-77PM-W3HX-F8MJ Apache Hive and Spark: CookieSigner exposes the correct signature when message verification fails

Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s servic...

CVE-2024-23945

Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s servic...

CVE-2024-23945: Generation of Error Message Containing Sensitive Information

Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s servic...

Information Disclosure

hive-service is vulnerable to information disclosure. The vulnerability exists because the verifyAndExtract function of CookieSigner.java uses a constant-time comparison for cookie signature verification, allowing an attacker to recover another user's cookie signature...

com.huemulsolutions.bigdata:huemul-bigdatagovernance (>=1.1, <=2.1), com.thinkbiganalytics.kylo:kylo-kerberos-test-client (0.10.0) +3 more potentially affected by CVE-2015-1772 via org.apache.hive:hive-service (1.1.0)

org.apache.hive:hive-service MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-service and may be impacted: - com.huemulsolutions.bigdata:huemul-bigdatagovernance =1.1, =2.1 -...

com.nflabs.zeppelin:zeppelin-cli (>=0.1.0, <=0.1.2), com.nflabs.zeppelin:zeppelin-server (>=0.1.0, <=0.1.2) +5 more potentially affected by CVE-2016-3083 via org.apache.hive:hive-service (0.9.0)

org.apache.hive:hive-service MAVEN version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-service and may be impacted: - com.nflabs.zeppelin:zeppelin-cli =0.1.0, =0.1.0, =0.1.0, =0.1.2 -...

com.nflabs.zeppelin:zeppelin-cli (0.2.0), com.nflabs.zeppelin:zeppelin-distribution (>=0.2.0, <=0.3.3) +13 more potentially affected by CVE-2016-3083 via org.apache.hive:hive-service (0.11.0)

org.apache.hive:hive-service MAVEN version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-service and may be impacted: - com.nflabs.zeppelin:zeppelin-cli 0.2.0 - com.nflabs.zeppelin:zeppelin-distribution =0.2.0, =0.3.0,...

com.mydataharbor:jdbc-hive-2.2.x-plugin (>=1.1.1, <=2.0.2) potentially affected by CVE-2017-12625 via org.apache.hive:hive-service (2.2.0)

org.apache.hive:hive-service MAVEN version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-service and may be impacted: - com.mydataharbor:jdbc-hive-2.2.x-plugin =1.1.1, =2.0.2 Source cves: CVE-2017-12625 Source advisory:...

org.aksw.sparqlify:sparqlify-cli (0.8.3), org.aksw.sparqlify:sparqlify-core (0.8.3) +2 more potentially affected by CVE-2017-12625 via org.apache.hive:hive-service (2.3.0)

org.apache.hive:hive-service MAVEN version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-service and may be impacted: - org.aksw.sparqlify:sparqlify-cli 0.8.3 - org.aksw.sparqlify:sparqlify-core 0.8.3 -...

org.aksw.sparqlify:sparqlify-cli (0.8.3), org.aksw.sparqlify:sparqlify-core (0.8.3) +2 more potentially affected by CVE-2017-12625 via org.apache.hive:hive-service (2.3.0)

org.apache.hive:hive-service MAVEN version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-service and may be impacted: - org.aksw.sparqlify:sparqlify-cli 0.8.3 - org.aksw.sparqlify:sparqlify-core 0.8.3 -...

com.alibaba.blink:flink-hcatalog (>=blink-3.2.0, <=1.5.1), com.datasalt.pangool:pangool-examples (>=0.60.0, <=0.70) +190 more potentially affected by CVE-2018-1284 via org.apache.hive:hive-service (>=0.8.0, <=2.3.2)

org.apache.hive:hive-service MAVEN version =0.8.0, =blink-3.2.0, =0.60.0, =1.0.1, =2.2.1, =2.2.2 - com.ge.research.semtk:nodegroupexecutionservice 2.2.2 - com.ge.research.semtk:nodegroupservice 2.2.2 - com.ge.research.semtk:nodegroupstoreservice 2.2.2 - com.ge.research.semtk:ontologyinfoservice...

org.aksw.sparqlify:sparqlify-cli (0.8.3), org.aksw.sparqlify:sparqlify-core (0.8.3) +2 more potentially affected by CVE-2017-12625 via org.apache.hive:hive-service (2.3.0)

org.apache.hive:hive-service MAVEN version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-service and may be impacted: - org.aksw.sparqlify:sparqlify-cli 0.8.3 - org.aksw.sparqlify:sparqlify-core 0.8.3 -...

Certificate Validation Bypass Due To SSL Vulnerability

hive-service is susceptible to certificate validation bypass. The client bypasses the validation of the common name attribute in the certificate of the server after sending an SSL request to it. Therefore, the client regards the certificate as a valid certificate and proceeds to the SSL handshake...