cve.bz

CVE-2020-1926

5.9 mediumEPSS 2.5%

Medium (5.9) in apache hive. EPSS 2.5% chance of exploitation in the next 30 days. Fixed in org.apache.hive:hive 2.3.8.

Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks. This could allow recovery of another users cookie signature. The issue was addressed in Apache Hive 2.3.8

Severity

CVSS 3.1

5.9 medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
2.5% chance of exploitation in the next 30 days; higher than 84% of CVEs (scores of 2026-10-31)
CWEs
CWE-203, CWE-208
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-54g4-5cf6-hjp3Mavenorg.apache.hive:hive<2.3.82.3.8

References

Check your stackJSON