CVE-2020-1926

—

CVSS 3.1

5.9 medium

EPSS

2%p83

Published

Mar 16, 2021 (Mar 16, 2021)

Modified

Jun 17, 2026

Description

Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks. This could allow recovery of another users cookie signature. The issue was addressed in Apache Hive 2.3.8

Vendors: apache
Products: hive
Weakness: CWE-208, CWE-203
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (2.5%)

In the news0 stories

No ingested article mentions this CVE yet.