← Vulnerability feed

Vulnerability record · CVE-2024-23945 · published 23 December 2024

CVE-2024-23945: Apache hive error message information leak vulnerability

Apache · Hive

Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s service component accidentally exposes the signed cookie to the end user when there is a mismatch in signature between the current and expected cookie. Exposing the correct cookie signature can lead to further exploitation. The vulnerable CookieSigner logic was introduced in Apache Hive by HIVE-9710 (1.2.0) and in Apache Spark by SPARK-14987 (2.0.0). The affected components are the following: * org.apache.hive:hive-service * org.apache.spark:spark-hive-thriftserver_2.11 * org.apache.spark:spark-hive-thriftserver_2.12

5.9 CVSS 3.1 Medium EPSS 1.6% · top 24.5% CWE-209 · Error message information leak
5.9CVSS 3.1 base score
1.6%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
9References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s service component accidentally exposes the signed cookie to the end user when there is a mismatch in signature between the current and expected cookie. Exposing the correct cookie signature can lead to further exploitation. The vulnerable CookieSigner logic was introduced in Apache Hive by HIVE-9710 (1.2.0) and in Apache Spark by SPARK-14987 (2.0.0). The affected components are the following: * org.apache.hive:hive-service * org.apache.spark:spark-hive-thriftserver_2.11 * org.apache.spark:spark-hive-thriftserver_2.12

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/apache/hive Product
https://github.com/apache/hive/commit/7638cb1a3b07713cc490aa2909a37037f89e08b4 Patch
https://github.com/apache/spark Product
https://github.com/apache/spark/commit/cf59b1f51c16301f689b4e0f17ba4dbd140e1b19 Patch
https://issues.apache.org/jira/browse/HIVE-9710 ExploitIssue TrackingPatchVendor Advisory
https://issues.apache.org/jira/browse/SPARK-14987 PatchVendor Advisory
https://lists.apache.org/thread/59r4mv7glrxpwkkdjvjbdljfpx3f5zzc Mailing ListVendor Advisory
https://lists.apache.org/thread/5o2ljnzrv8zvhjw9vy7b4rwjpc32hgfc Mailing ListVendor Advisory
http://www.openwall.com/lists/oss-security/2024/12/23/2 Mailing ListThird Party Advisory

Track CVE-2024-23945 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2022-33891Apache Spark UI ACL impersonation leads to OS command injectionApache Spark's UI ACL feature (spark.acls.enable) contains a flaw in HttpSecurityFilter where a user can supply an arbitrary username to impersonate …KEVEPSS 93%analysed9.9CVE-2023-22946Apache spark improper privilege management vulnerabilityIn Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application c…EPSS 1.1%9.8CVE-2026-49845Apache hive code injection vulnerabilitySQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with acc…EPSS 0.89%9.8CVE-2020-9480Apache spark missing authentication for critical function vulnerabilityIn Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shar…EPSS 30%9.8CVE-2018-21234Jodd deserialization of untrusted data vulnerabilityJodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set.EPSS 8.3%9.8CVE-2018-17190Apache spark vulnerabilityIn all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'worker' hos…EPSS 8.8%9.1CVE-2026-55976Apache hive server-side request forgery (ssrf) vulnerabilityServer-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TA…EPSS 1.0%9.1CVE-2019-20445Netty http request smuggling vulnerabilityHttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-En…EPSS 14%

Source: NIST National Vulnerability Database (record CVE-2024-23945), CISA KEV, FIRST EPSS (scores of 2026-11-14). This page is refreshed as NVD updates the record.