TI-2024-15934 Aliases CVE-2024-23953 GHSA-p953-3j66-hg45

Apache Hive: Timing Attack Against Signature in LLAP util

LOW 32CWE-208Published 2025-01-28 · Updated 2025-03-14

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure, Security bypass
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-208 and CWE-290.

Summary

Use of Arrays.equals() in LlapSignerImpl in Apache Hive to compare message signatures allows attacker to forge a valid signature for an arbitrary message byte by byte. The attacker should be an authorized user of the product to perform this attack. Users are recommended to upgrade to version 4.0.0, which fixes this issue. The problem occurs when an application doesn’t use a constant-time algorithm for validating a signature. The method Arrays.equals() returns false right away when it sees that one of the input’s bytes are different. It means that the comparison time depends on the contents of the arrays. This little thing may allow an attacker to forge a valid signature for an arbitrary message byte by byte. So it might allow malicious users to submit splits/work with selected signatures to LLAP without running as a privileged user, potentially leading to DDoS attack. More details in the reference section.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01426 73rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Apache Hive (Apache Software Foundation): 4.0.0org.apache.hive:hive-llap-common (Maven): 4.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache Hive	2.2.0 to before 4.0.0	4.0.0	Patch available	CNA
—	org.apache.hive:hive-llap-common (Maven)	before 4.0.0	4.0.0	Patch available	GHSA-p953-3j66-hg45

Apache Hive VendorApache Affected 2.2.0 to before 4.0.0 Fixed in 4.0.0 Patch available CNA
org.apache.hive:hive-llap-common (Maven) Vendor— Affected before 4.0.0 Fixed in 4.0.0 Patch available GHSA-p953-3j66-hg45

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:hive::::::::	2.2.0 to before 4.0.0	Vulnerable	Apache

cpe:2.3:a:apache:hive:*:*:*:*:*:*:*:* Versions 2.2.0 to before 4.0.0 Vulnerable ·Apache

Remediation

Fix · CNA Apache Hive (Apache Software Foundation) Fixed in 4.0.0
Fix · GHSA-p953-3j66-hg45 org.apache.hive:hive-llap-common (Maven) Fixed in 4.0.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2024-23953
2026-10-03 Alias added: GHSA-p953-3j66-hg45

References

Exploit 1

https://blog.gypsyengineer.com/en/security/preventing-timing-attacks-with-codeql.html

Patch 2

Advisory 3

Other 3

TI-2018-15196 Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set. CVSS 3.1CRITICAL 9.8
TI-2026-40376 Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url CVSS 3.1CRITICAL 9.1
TI-2018-01187 SQL injection in Apache Hive CVSS 3.0CRITICAL 9.1
TI-2026-36749 Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths CVSS 3.1CRITICAL 9.8
TI-2015-06259 The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1… CVSS 3.0HIGH 8.3
TI-2020-10925 Uncontrolled resource consumption in Apache Thrift CVSS 3.1HIGH 7.5

See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences