-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.hive:hive-service | maven | >= 1.2.0, < 4.0.0 | 4.0.0 |
| org.apache.spark:spark-hive-thriftserver_2.11 | maven | <= 2.4.8 | |
| org.apache.spark:spark-hive-thriftserver_2.12 | maven | < 3.4.2 | 3.4.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from error message generation in the CookieSigner's.verifyAndExtract method. Both Hive and Spark implementations originally included the originalSignature (correct signature) in exception messages when signature validation failed, as shown in the commit diffs. This violates CWE-209 by exposing cryptographic material through error messages. The patches (7638cb1 for Hive, cf59b1f for Spark) explicitly remove the sensitive signature details from error messages, confirming these functions as the root cause.
JavaJavaOngoing coverage of React2Shell