CVE-2020-1926: Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks. This could allow recovery of…

PriorityP429medium5.9CVSS 3.1

AVNACHPRNUINSUCHINAN

EPSS

2.46%

82.6th percentile

Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks. This could allow recovery of another users cookie signature. The issue was addressed in Apache Hive 2.3.8

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apache	hive	< 2.3.8	2.3.8
apache_software_foundation	apache_hive	>= Apache Hive < 2.3.8	2.3.8

CVSS provenance

nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.