Timing attack in Cookie signature verification

published 2021-03-16 5 y ago modified 2026-06-17 4 mo ago also GHSA-54g4-5cf6-hjp3 , EUVD-2022-0830

cvss: 5.9; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 2.5%; EPSS 2.5% chance of exploitation in 30 days, percentile 84%
public exploits: 0; none known

Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks. This could allow recovery of another users cookie signature. The issue was addressed in Apache Hive 2.3.8

Patch / fix

fixed in 2 links 2

maven org.apache.hive:hive 2.3.8
Apache Software Foundation Apache Hive 2.3.8

Exploit prediction

2.46% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	4.3	AV:N/AC:M/Au:N/C:P/I:N/A:N
GitHub	3.1	5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
maven	org.apache.hive:hive	<2.3.8	2.3.8

Affected products

Apache Software Foundation Apache Hive

Classification

Weakness

CWE-208 Observable Timing Discrepancy
CWE-203 Observable Discrepancy
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

issues.apache.org /jira/browse/HIVE-22708
web, issue-tracking, patch, vendor-advisory
lists.apache.org /thread.html/rd186eedff68102ba1e68059a808101c5aa587e11542c7dcd26e7b9d7%40%3Cuser.hive.apache.org%3E
web, mailing-list, patch, vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2020-1926
advisory

Sources

CVE List CVE-2020-1926
GitHub Advisory GHSA-54g4-5cf6-hjp3
NVD CVE-2020-1926

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary