CVE-2020-1926: apache software foundation apache hive Observable Timing Discrepancy
CVSS: 5.9v3.1MediumModified
AliasesGHSA-54g4-5cf6-hjp3
Published 16-03-2021Last modified 13-02-2025
Vulnerability summary
CVE-2020-1926 is a medium (CVSS 5.9) Observable Timing Discrepancy vulnerability in apache software foundation apache hive. EPSS estimates a 2.46% chance of exploitation in the next 30 days, higher than 84.1% of scored vulnerabilities.
CVSS score
5.9/10
010
Medium · v3.1 (NVD)EPSS score
2.46%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 16-03-2021PublishedVulnerability first disclosed.
- 13-02-2025Last modifiedVulnerability information updated.
Description
Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks. This could allow recovery of another users cookie signature. The issue was addressed in Apache Hive 2.3.8
CVSS metrics
3 scores · 2 sources · 2 versionsMedium 5.9Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NSourcesAll 2 agree
- OSV · MavenEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Medium 4.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
2.46%
Chance of exploitation in the next 30 days
Percentile
84%
Versus all other CVEs
30-day change
0.00 pp
From 2.46% on 18-09-2026
18-09-202618-10-2026
EPSS score2.46%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-208Observable Timing DiscrepancyTwo separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
- CWE-203Observable DiscrepancyThe product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
Affected systems
Apache1 product
- hive< 2.3.8
Apache software foundation1 product
- apache hive≥ Apache Hive, < 2.3.8
Org.apache.hive1 product
- hive< 2.3.8
3 vendors · 3 products
