CVE-2020-1926CWE-208

Timing attack in Cookie signature verification

published March 16, 2021

CVSS
—
EPSS
2%
Percentile
84.3
In the wild
Unconfirmed
What it is

Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks. This could allow recovery of another users cookie signature. The issue was addressed in Apache Hive 2.3.8

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02458 · 84.3th percentile
Weakness
CWE-208 · Observable Timing Discrepancy
Published
2021-03-16T13:00Z
EPSS history
Timeline
  • 16 MAR 13:00Z
    Timing attack in Cookie signature verification
    cvelistv5