CVE-2024-23945

CVE-2024-23945 → CookieSigner exposes the correct cookie signature to end users when a signature mismatch occurs. Affected: Hive service component and Spark Hive-ThriftServer (versions tied to HIVE-9710 1.2.0 and SPARK-14987 2.0.0). Root cause: flawed CookieSigner logic allows exposure of the sig...

CVE-2020-1926

CVE-2020-1926 affects Apache Hive: cookie signature verification used a non-constant-time comparison, enabling timing attacks that could recover another user’s cookie signature. The issue is addressed in Apache Hive 2.3.8. Connected references describe the vulnerability as an information-disclosu...

CVE-2024-29869

CVE-2024-29869 describes a permission misconfiguration where Hive writes a credentials file to a temporary directory with 644 permissions when unconstrained, allowing read access by unauthorized users. The issue is documented for Hive and is reflected in IBM watsonx.data advisories, which cite af...

CVE-2025-62728

CVE-2025-62728 (Apache Hive) : SQL injection in the Hive Metastore Server (HMS) when handling delete column statistics via Thrift APIs. Exploitation is limited to trusted/authorized callers with direct Thrift access; in typical deployments HMS is not publicly exposed and the issue is mitigated if...