[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAFQnWdYMsAR7PXSYRBn_jfcLfV-XYDoWAauBKaxJQrjfyBpNjQ@mail.gmail.com>
Date: Mon, 23 Dec 2024 15:32:55 +0100
From: Stamatis Zampetakis <zabetak@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2024-23945: Apache Hive and Spark: CookieSigner exposes the
correct signature when message verification fails
Severity: important
Affected versions:
- Apache Hive 1.2.0 before 4.0.0
- Apache Spark 2.0.0 before 3.0.0
- Apache Spark 3.0.0 before 3.3.4
- Apache Spark 3.4.0 before 3.4.2
- Apache Spark 3.5.0
Description:
Signing cookies is an application security feature that adds a digital
signature to cookie data to verify its authenticity and integrity. The
signature helps prevent malicious actors from modifying the cookie
value, which can lead to security vulnerabilities and exploitation.
Apache Hive’s service component accidentally exposes the signed cookie
to the end user when there is a mismatch in signature between the
current and expected cookie. Exposing the correct cookie signature can
lead to further exploitation.
The vulnerable CookieSigner logic was introduced in Apache Hive by
HIVE-9710 (1.2.0) and in Apache Spark by SPARK-14987 (2.0.0). The
affected components are the following:
* org.apache.hive:hive-service
* org.apache.spark:spark-hive-thriftserver_2.11
* org.apache.spark:spark-hive-thriftserver_2.12
Credit:
Kostya Kortchinsky (reporter)
Hamza Tahmi (reporter)
References:
https://github.com/apache/hive
https://github.com/apache/spark
https://github.com/apache/spark/commit/cf59b1f51c16301f689b4e0f17ba4dbd140e1b19
https://github.com/apache/hive/commit/7638cb1a3b07713cc490aa2909a37037f89e08b4
https://issues.apache.org/jira/browse/HIVE-9710
https://issues.apache.org/jira/browse/SPARK-14987
https://hive.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-23945
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
