Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks. This could allow recovery of another users cookie signature. The issue was addressed in Apache Hive 2.3.8
{ "nvd_published_at": "2021-03-16T13:15:00Z", "github_reviewed_at": "2021-03-31T21:30:08Z", "severity": "MODERATE", "github_reviewed": true, "cwe_ids": [ "CWE-200", "CWE-203", "CWE-208" ] }