Information Exposure Through Timing Discrepancy in Apache Hive - CVE-2024-23953
Published: June 30, 2025
Vulnerability identifier: #VU112037
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-23953
CWE-ID: CWE-208
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to modify data on the system.
The vulnerability occurs when an application doesn’t use a constant-time algorithm for validating a signature. A remote user can use of Arrays.equals() in LlapSignerImpl in Apache Hive to compare message signatures and forge a valid signature for an arbitrary message byte by byte.
Affected software
Apache Hive
Netcool Operations Insight
watsonx.data
IBM Cloud Pak for Watson AIOps
Netcool Operations Insight
watsonx.data
IBM Cloud Pak for Watson AIOps
How to mitigate CVE-2024-23953
Install updates from vendor's website.
Apache Hive - update to 4.0.0
Netcool Operations Insight - update to 1.6.15
watsonx.data - update to 2.2.1
IBM Cloud Pak for Watson AIOps - update to 4.10.0
Netcool Operations Insight - update to 1.6.15
watsonx.data - update to 2.2.1
IBM Cloud Pak for Watson AIOps - update to 4.10.0
External References
- http://www.openwall.com/lists/oss-security/2025/01/28/3
- https://blog.gypsyengineer.com/en/security/preventing-timing-attacks-with-codeql.html
- https://cqr.company/web-vulnerabilities/timing-attacks/
- https://github.com/apache/hive
- https://github.com/apache/hive/commit/b418e3c9f479ba8e7d31e6470306111002ffa809
- https://issues.apache.org/jira/browse/HIVE-28030
- https://lists.apache.org/thread/0nloywj49nbtlc6l3c6363qvq7o1ztb7