Timing Attack in Apache Hive Allows Signature Forgery by Authorized Users

CVE-2024-23953

What is CVE-2024-23953?

A vulnerability in Apache Hive's LlapSignerImpl allows an attacker, who is already an authorized user, to forge valid signatures for arbitrary messages by exploiting the non-constant time behavior of the Arrays.equals() method. This flaw permits attackers to manipulate message validation, potentially leading to malicious submissions to LLAP. The associated issue could enable unauthorized activities, such as Denial of Service (DDoS) attacks, as it relies on the differences in signature comparison times. Users are strongly advised to upgrade to version 4.0.0 or later to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References