Timing Attack in Apache Hive Allows Signature Forgery by Authorized Users

CVE-2024-23953

Summary

A vulnerability in Apache Hive's LlapSignerImpl allows an attacker, who is already an authorized user, to forge valid signatures for arbitrary messages by exploiting the non-constant time behavior of the Arrays.equals() method. This flaw permits attackers to manipulate message validation, potentially leading to malicious submissions to LLAP. The associated issue could enable unauthorized activities, such as Denial of Service (DDoS) attacks, as it relies on the differences in signature comparison times. Users are strongly advised to upgrade to version 4.0.0 or later to mitigate this risk.

References