Red Hat OpenShift 访问控制错误漏洞

Red Hat OpenShift is a Platform-as-a-Service PaaS cloud computing platform from Red Hat USA that supports building, testing, deploying and running applications. An access control error vulnerability exists in Red Hat OpenShift. An attacker exploiting this vulnerability could gain cluster...

PT-2024-20772 · Red Hat +1 · Openshift Dedicated +1

Name of the Vulnerable Software and Affected Versions: OpenShift Dedicated affected versions not specified Description: A flaw was found in the Hive ClusterDeployments resource in OpenShift Dedicated. In certain conditions, this issue may allow a developer account on a Hive-enabled cluster to...

co.elastic.release-test:dist (=9.0.4), co.elastic.release-test:elasticsearch-hadoop-hive (=9.0.4) +194 more potentially affected by CVE-2024-23945 via org.apache.hive:hive-service (>=1.2.0 <=4.0.0-beta-1)

org.apache.hive:hive-service MAVEN version =1.2.0, =5.0.0, =1.7.0, =3.0.0, =0.1.1, =2.0.1-preview, =2.0.0, =5.0.1 - com.hotels:mutant-swarm =1.1.0 - com.hotels:waggle-dance =4.0.0 - com.hotels:waggle-dance-boot =4.0.0 - com.hotels:waggle-dance-core =4.0.0 and more Source cves: CVE-2024-23945 Sour...

com.pingcap.tispark:spark-wrapper-spark-2.4 (>=2.4.4-scala_2.12 <=2.4.4-scala_2.12-RC2), com.pingcap.tispark:spark-wrapper-spark-3.0 (>=2.5.0 <=2.5.3) +21 more potentially affected by CVE-2024-23945 via org.apache.spark:spark-hive-thriftserver_2.12 (>=2.4.8 <=3.3.1)

org.apache.spark:spark-hive-thriftserver2.12 MAVEN version =2.4.8, =2.4.4-scala2.12, =2.5.0, =3.0.1, =2.5.0, =3.0.1, =3.0.1, =3.1.0, =2.4.4-scala2.12, =2.5.1, =3.0.1, =2.5.1, =3.0.1, =3.0.1, =3.1.0, =2.4.4-scala2.12, =3.2.3 and more Source cves: CVE-2024-23945 Source advisory:...

ch.ninecode.cim:CIMReader (>=2.11-2.1.1-2.2.0 <=2.11-2.3.1-3.4.0), com.hindog.grid:grid-executor-examples_2.11 (>=2.0.2 <=2.0.7) +29 more potentially affected by CVE-2024-23945 via org.apache.spark:spark-hive-thriftserver_2.11 (>=2.1.0 <=2.4.8)

org.apache.spark:spark-hive-thriftserver2.11 MAVEN version =2.1.0, =2.11-2.1.1-2.2.0, =2.0.2, =1.0, =2.2.0, =2.2.0, =2.2.0, =1.0, =2.3.0, =1.0, =1.100.100-SNAPSHOT-2.3.0, =1.4.0, =2.0.0, =1.6.0, =1.1.0, =1.5.1 and more Source cves: CVE-2024-23945 Source advisory: OSV:GHSA-77PM-W3HX-F8MJ...

GHSA-77PM-W3HX-F8MJ Apache Hive and Spark: CookieSigner exposes the correct signature when message verification fails

Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s servic...

Apache Hive and Spark: CookieSigner exposes the correct signature when message verification fails

Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s servic...

CVE-2024-23945

Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s servic...

CVE-2024-23945 Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification fails

Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s servic...

CVE-2024-23945 Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification fails

Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s servic...

EUVD-2024-3564

Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s servic...

CVE-2024-23945

CVE-2024-23945 → CookieSigner exposes the correct cookie signature to end users when a signature mismatch occurs. Affected: Hive service component and Spark Hive-ThriftServer (versions tied to HIVE-9710 1.2.0 and SPARK-14987 2.0.0). Root cause: flawed CookieSigner logic allows exposure of the sig...

CVE-2024-23945 Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification fails

Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s servic...

Apache Hive和Apache Spark 安全漏洞

Apache Hive and Apache Spark are both products of the Apache Foundation, USA.Apache Hive is a suite of data warehouse software based on Hadoop Distributed Systems Infrastructure. The software provides a data integration approach and a high-level query language to support large-scale data analysis...

CVE-2024-54321

Cross-Site Request Forgery CSRF vulnerability in Hive Support Hive Support hive-support allows Cross Site Request Forgery.This issue affects Hive Support: from n/a through = 1.1.2...

CVE-2024-54304

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Hive Support Hive Support hive-support allows SQL Injection.This issue affects Hive Support: from n/a through = 1.1.2...

CVE-2024-54321 WordPress Hive Support plugin <= 1.1.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Hive Support Hive Support – WordPress Help Desk allows Cross Site Request Forgery.This issue affects Hive Support – WordPress Help Desk: from n/a through 1.1.2...

CVE-2024-54321 WordPress Hive Support plugin <= 1.1.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Hive Support Hive Support hive-support allows Cross Site Request Forgery.This issue affects Hive Support: from n/a through = 1.1.2...

CVE-2024-54321

CVE-2024-54321: CSRF vulnerability in the Hive Support WordPress Help Desk plugin; affects Hive Support – WordPress Help Desk versions up to 1.1.2. The connected documents confirm CSRF wording but do not provide detailed exploit steps, affected files, root cause, or a concrete mitigation beyond t...

CVE-2024-54304 WordPress Hive Support plugin <= 1.1.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Hive Support Hive Support – WordPress Help Desk allows SQL Injection.This issue affects Hive Support – WordPress Help Desk: from n/a through 1.1.2...