Every CVE Search/ Get API key

CVE-2024-23945

Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification fails

5.9 MediumFix available

Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s service component accidentally exposes the signed cookie to the end user when there is a mismatch in signature between the current and expected cookie. Exposing the correct cookie signature can lead to further exploitation.

The vulnerable CookieSigner logic was introduced in Apache Hive by HIVE-9710 (1.2.0) and in Apache Spark by SPARK-14987 (2.0.0). The affected components are the following:

  • org.apache.hive:hive-service
  • org.apache.spark:spark-hive-thriftserver_2.11
  • org.apache.spark:spark-hive-thriftserver_2.12

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

1.55%Up 1.5 points since Dec 24, 2024
90%50%10%1%

What each source reports

CVE List Score used 5.9

Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification fails

Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s service component accidentally exposes the signed cookie to the end user when there is a mismatch in signature between the current and expected cookie. Exposing the correct cookie signature can lead to further exploitation.

The vulnerable CookieSigner logic was introduced in Apache Hive by HIVE-9710 (1.2.0) and in Apache Spark by SPARK-14987 (2.0.0). The affected components are the following:

  • org.apache.hive:hive-service
  • org.apache.spark:spark-hive-thriftserver_2.11
  • org.apache.spark:spark-hive-thriftserver_2.12
Record
CVE-2024-23945
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-209, CWE-209
Updated
2026-11-02
EUVDEUVD-2024-3564 5.9

Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s service component accidentally exposes the signed cookie to the end user when there is a mismatch in signature between the current and expected cookie. Exposing the correct cookie signature can lead to further exploitation.

The vulnerable CookieSigner logic was introduced in Apache Hive by HIVE-9710 (1.2.0) and in Apache Spark by SPARK-14987 (2.0.0). The affected components are the following:

  • org.apache.hive:hive-service
  • org.apache.spark:spark-hive-thriftserver_2.11
  • org.apache.spark:spark-hive-thriftserver_2.12
Record
EUVD-2024-3564
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-77pm-w3hx-f8mj 8.7

Apache Hive and Spark: CookieSigner exposes the correct signature when message verification fails

Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s service component accidentally exposes the signed cookie to the end user when there is a mismatch in signature between the current and expected cookie. Exposing the correct cookie signature can lead to further exploitation.

The vulnerable CookieSigner logic was introduced in Apache Hive by HIVE-9710 (1.2.0) and in Apache Spark by SPARK-14987 (2.0.0). The affected components are the following:

  • org.apache.hive:hive-service
  • org.apache.spark:spark-hive-thriftserver_2.11
  • org.apache.spark:spark-hive-thriftserver_2.12
Record
GHSA-77pm-w3hx-f8mj
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-209
Updated
2026-11-02
NVD 5.9

Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s service component accidentally exposes the signed cookie to the end user when there is a mismatch in signature between the current and expected cookie. Exposing the correct cookie signature can lead to further exploitation.

The vulnerable CookieSigner logic was introduced in Apache Hive by HIVE-9710 (1.2.0) and in Apache Spark by SPARK-14987 (2.0.0). The affected components are the following:

  • org.apache.hive:hive-service
  • org.apache.spark:spark-hive-thriftserver_2.11
  • org.apache.spark:spark-hive-thriftserver_2.12
Record
CVE-2024-23945
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-209
Updated
2026-11-02
OSV 5.9

Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification fails

Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s service component accidentally exposes the signed cookie to the end user when there is a mismatch in signature between the current and expected cookie. Exposing the correct cookie signature can lead to further exploitation.

The vulnerable CookieSigner logic was introduced in Apache Hive by HIVE-9710 (1.2.0) and in Apache Spark by SPARK-14987 (2.0.0). The affected components are the following:

  • org.apache.hive:hive-service
  • org.apache.spark:spark-hive-thriftserver_2.11
  • org.apache.spark:spark-hive-thriftserver_2.12
Record
CVE-2024-23945
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-209
Updated
2026-11-02
OSVGHSA-77pm-w3hx-f8mj 8.7

Apache Hive and Spark: CookieSigner exposes the correct signature when message verification fails

Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s service component accidentally exposes the signed cookie to the end user when there is a mismatch in signature between the current and expected cookie. Exposing the correct cookie signature can lead to further exploitation.

The vulnerable CookieSigner logic was introduced in Apache Hive by HIVE-9710 (1.2.0) and in Apache Spark by SPARK-14987 (2.0.0). The affected components are the following:

  • org.apache.hive:hive-service
  • org.apache.spark:spark-hive-thriftserver_2.11
  • org.apache.spark:spark-hive-thriftserver_2.12
Record
GHSA-77pm-w3hx-f8mj
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-209
Updated
2026-11-02
OSVOESA-2025-1039 5.9

spark security update

Apache Spark achieves high performance for both batch and streaming data, using a state-of-the-art DAG scheduler, a query optimizer, and a physical execution engine.

Security Fix(es):

Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s service component accidentally exposes the signed cookie to the end user when there is a mismatch in signature between the current and expected cookie. Exposing the correct cookie signature can lead to further exploitation. The vulnerable CookieSigner logic was introduced in Apache Hive by HIVE-9710 (1.2.0) and in Apache Spark by SPARK-14987 (2.0.0). The affected components are the following: * org.apache.hive:hive-service * org.apache.spark:spark-hive-thriftserver_2.11 * org.apache.spark:spark-hive-thriftserver_2.12(CVE-2024-23945)

Record
OESA-2025-1039
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.hive:hive-service
Maven
 1.2.0 up to 4.0.0
4.0.0
org.apache.spark:spark-hive-thriftserver_2.11
Maven
 through 2.4.8 None known
org.apache.spark:spark-hive-thriftserver_2.12
Maven
 before 3.4.2
3.4.2
org.apache.hive:hive-service
Maven
 1.2.0 up to 4.0.0, plus listed versions
1.2.11.2.22.0.02.0.12.1.0
Show 21 moreShow less
2.1.12.2.02.3.02.3.12.3.102.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.93.0.03.1.03.1.13.1.23.1.34.0.0-alpha-14.0.0-alpha-24.0.0-beta-1
4.0.0
org.apache.spark:spark-hive-thriftserver_2.11
Maven
 through 2.4.8, plus listed versions
1.6.32.0.02.0.0-preview2.0.12.0.2
Show 21 moreShow less
2.1.02.1.12.1.22.1.32.2.02.2.12.2.22.2.32.3.02.3.12.3.22.3.32.3.42.4.02.4.12.4.22.4.32.4.42.4.52.4.62.4.7
 None known
org.apache.spark:spark-hive-thriftserver_2.12
Maven
 before 3.4.2, plus listed versions
2.4.02.4.12.4.22.4.32.4.4
Show 26 moreShow less
2.4.52.4.62.4.72.4.83.0.03.0.0-preview3.0.0-preview23.0.13.0.23.0.33.1.03.1.13.1.23.1.33.2.03.2.13.2.23.2.33.2.43.3.03.3.13.3.23.3.33.3.43.4.03.4.1
3.4.2
spark
openEuler:22.03-LTS-SP3
 before 3.2.2-2.oe2203sp3
3.2.2-2.oe2203sp3
spark
openEuler:20.03-LTS-SP4
 before 3.2.0-3.oe2003sp4
3.2.0-3.oe2003sp4
spark
openEuler:22.03-LTS-SP1
 before 3.2.2-2.oe2203sp1
3.2.2-2.oe2203sp1
spark
openEuler:24.03-LTS
 before 3.5.0-5.oe2403sp1
3.5.0-5.oe2403sp1
spark
openEuler:22.03-LTS-SP4
 before 3.2.2-3.oe2203sp4
3.2.2-3.oe2203sp4
spark
openEuler:24.03-LTS-SP1
 before 3.5.0-5.oe2403sp1
3.5.0-5.oe2403sp1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-23945 is a medium vulnerability (CVSS 5.9) in Apache Hive, published December 23, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.55%, the 75th percentile. Fixed in org.apache.hive:hive-service 4.0.0.

References

Show 8 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open