Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS03N3BtLXczaHgtZjhtas4ABCrS

Apache Hive and Spark: CookieSigner exposes the correct signature when message verification fails

Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s service component accidentally exposes the signed cookie to the end user when there is a mismatch in signature between the current and expected cookie. Exposing the correct cookie signature can lead to further exploitation.

The vulnerable CookieSigner logic was introduced in Apache Hive by HIVE-9710 (1.2.0) and in Apache Spark by SPARK-14987 (2.0.0). The affected components are the following:

Permalink: https://github.com/advisories/GHSA-77pm-w3hx-f8mj
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03N3BtLXczaHgtZjhtas4ABCrS
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 16 days ago
Updated: 13 days ago


CVSS Score: 5.9
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS Percentage: 0.00044
EPSS Percentile: 0.14745

Identifiers: GHSA-77pm-w3hx-f8mj, CVE-2024-23945
References: Repository: https://github.com/apache/hive
Blast Radius: 17.6

Affected Packages

maven:org.apache.spark:spark-hive-thriftserver_2.12
Dependent packages: 11
Dependent repositories: 15
Downloads:
Affected Version Ranges: < 3.4.2
Fixed in: 3.4.2
All affected versions: 2.4.0, 2.4.1, 2.4.2, 2.4.3, 2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8, 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.3.0, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.4.0, 3.4.1
All unaffected versions: 3.4.2, 3.4.3, 3.4.4, 3.5.0, 3.5.1, 3.5.2, 3.5.3, 3.5.4
maven:org.apache.spark:spark-hive-thriftserver_2.11
Dependent packages: 22
Dependent repositories: 63
Downloads:
Affected Version Ranges: <= 2.4.8
No known fixed version
All affected versions: 1.6.3, 2.0.0, 2.0.1, 2.0.2, 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.3.0, 2.3.1, 2.3.2, 2.3.3, 2.3.4, 2.4.0, 2.4.1, 2.4.2, 2.4.3, 2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8
maven:org.apache.hive:hive-service
Dependent packages: 150
Dependent repositories: 962
Downloads:
Affected Version Ranges: >= 1.2.0, < 4.0.0
Fixed in: 4.0.0
All affected versions: 1.2.0, 1.2.1, 1.2.2, 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.3.3, 2.3.4, 2.3.5, 2.3.6, 2.3.7, 2.3.8, 2.3.9, 2.3.10, 3.0.0, 3.1.0, 3.1.1, 3.1.2, 3.1.3
All unaffected versions: 0.8.0, 0.8.1, 0.9.0, 0.10.0, 0.11.0, 0.12.0, 0.13.0, 0.13.1, 0.14.0, 1.0.0, 1.0.1, 1.1.0, 1.1.1, 4.0.0, 4.0.1