Apache Hive 2.2.x/3.x LlapSignerImpl Arrays.equals integrity check

Summaryinfo

A vulnerability labeled as problematic has been found in Apache Hive 2.2.x/3.x. Affected by this vulnerability is the function Arrays.equals of the component LlapSignerImpl. The manipulation results in integrity check. This vulnerability was named CVE-2024-23953. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Apache Hive 2.2.x/3.x. Affected is the function Arrays.equals of the component LlapSignerImpl. The manipulation with an unknown input leads to a integrity check vulnerability. CWE is classifying the issue as CWE-354. The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission. This is going to have an impact on availability. CVE summarizes:

Use of Arrays.equals() in LlapSignerImpl in Apache Hive to compare message signatures allows attacker to forge a valid signature for an arbitrary message byte by byte. The attacker should be an authorized user of the product to perform this attack. Users are recommended to upgrade to version 4.0.0, which fixes this issue. The problem occurs when an application doesn’t use a constant-time algorithm for validating a signature. The method Arrays.equals() returns false right away when it sees that one of the input’s bytes are different. It means that the comparison time depends on the contents of the arrays. This little thing may allow an attacker to forge a valid signature for an arbitrary message byte by byte. So it might allow malicious users to submit splits/work with selected signatures to LLAP without running as a privileged user, potentially leading to DDoS attack. More details in the reference section.

The advisory is available at lists.apache.org. This vulnerability is traded as CVE-2024-23953 since 01/24/2024. The exploitability is told to be difficult. Technical details are known, but there is no available exploit.

Upgrading to version 4.0.0 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Apache

Name

• Hive

Version

• 2.2.x
• 3.x

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion