{"id":"CVE-2020-1926","details":"Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks. This could allow recovery of another users cookie signature. The issue was addressed in Apache Hive 2.3.8","aliases":["GHSA-54g4-5cf6-hjp3"],"modified":"2026-07-08T20:30:44.605779Z","published":"2021-03-16T13:15:11.893Z","references":[{"type":"FIX","url":"https://issues.apache.org/jira/browse/HIVE-22708"},{"type":"FIX","url":"https://lists.apache.org/thread.html/rd186eedff68102ba1e68059a808101c5aa587e11542c7dcd26e7b9d7%40%3Cuser.hive.apache.org%3E"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/hive","events":[{"introduced":"0"},{"fixed":"f1e87137034e4ecbe39a859d4ef44319800016d7"}],"database_specific":{"cpe":"cpe:2.3:a:apache:hive:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"2.3.8"}],"source":"CPE_RANGE"}}],"versions":["release-2.3.8-rc2","release-2.3.8-rc1","release-2.3.8-rc0","rel/release-2.3.7","rel/release-2.3.6","release-2.3.5-rc0","rel/release-2.3.5","rel/release-2.3.4","rel/release-2.3.2","rel/release-2.3.1","rel/release-2.3.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-1926.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}