Lucene search

CVE-2024-23945 Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification fails

🗓️ 23 Dec 2024 15:54:26Reported by apacheType

CookieSigner exposes correct signature upon verification failure, risking exploitation in Apache Hive and Spark.

Reporter	Title	Published	Views	Family All 7
Cvelist	CVE-2024-23945 Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification fails	23 Dec 202415:26	–	cvelist
Github Security Blog	Apache Hive and Spark: CookieSigner exposes the correct signature when message verification fails	23 Dec 202418:30	–	github
OSV	Apache Hive and Spark: CookieSigner exposes the correct signature when message verification fails	23 Dec 202418:30	–	osv
OSV	CVE-2024-23945	23 Dec 202416:15	–	osv
CVE	CVE-2024-23945	23 Dec 202416:15	–	cve
Veracode	Sensitive Information Exposure	8 Jan 202504:39	–	veracode
NVD	CVE-2024-23945	23 Dec 202416:15	–	nvd

Source	Link
issues	www.issues.apache.org/jira/browse/HIVE-9710
lists	www.lists.apache.org/thread/5o2ljnzrv8zvhjw9vy7b4rwjpc32hgfc
lists	www.lists.apache.org/thread/59r4mv7glrxpwkkdjvjbdljfpx3f5zzc
issues	www.issues.apache.org/jira/browse/SPARK-14987
github	www.github.com/apache/hive
github	www.github.com/apache/hive/commit/7638cb1a3b07713cc490aa2909a37037f89e08b4
github	www.github.com/apache/spark
github	www.github.com/apache/spark/commit/cf59b1f51c16301f689b4e0f17ba4dbd140e1b19

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

23 Dec 2024 15:26Current

7High risk

Vulners AI Score7

EPSS0.0004

SSVC

CWE-209

cve-2024-23945 apache hive apache spark cookiesigner signature exposure security vulnerability