StackRadar

CVE-2024-23945

Medium

Advisory

Published 23 Dec 2024In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
5.9
base score, highest
EPSS
0.015
73rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
18
of 17,781 indexed, latest versions
Container images
14
deployed by those charts
Fix available
1 of 2
affected packages

Apache Hive and Spark: CookieSigner exposes the correct signature when message verification fails

Carried by container images the latest versions of 18 of 17,781 indexed charts deploy, on 14 images.

Affected packageAffected versionsFixed inImages
hive-servicemaven2.3.2, 2.3.4, 2.3.9, 3.1.34.0.010
spark-hive-thriftserver_2.11maven2.2.0, 2.2.0-k8s-0.5.0, 2.4.0, 2.4.4no fix listed4
OSV records
GHSA-77pm-w3hx-f8mj

Charts affected

18 by stars
ChartLatestAffected imagesRadar Score
metabasedeliveryheroVerified publisher0.14.41 of 1See more

metabase deliveryhero 0.14.4

1 of the 1 container images this version deploys carry CVE-2024-23945.

Container imageDigestPackageFixed in
metabase/metabase:v0.45.21fb334ce4820
hive-service@3.1.3
4.0.0

Open the chart page →

2,572
sparkmicrosoft1.0.41 of 3See more

spark microsoft 1.0.4

1 of the 3 container images this version deploys carry CVE-2024-23945.

Container imageDigestPackageFixed in
dbanda/livy:0.80ca125e68e53
spark-hive-thriftserver_2.11@2.2.0
no fix listed

Open the chart page →

13,738
hivebigdata-chartsVerified publisher0.1.81 of 1See more

hive bigdata-charts 0.1.8

1 of the 1 container images this version deploys carry CVE-2024-23945.

Container imageDigestPackageFixed in
5200710/hive:3.1.3-postgresql-metastoree34ab066d2ed
hive-service@3.1.3
4.0.0

Open the chart page →

7,166
hivedmwm-bigdataVerified publisher0.1.62 of 5See more

hive dmwm-bigdata 0.1.6

2 of the 5 container images this version deploys carry CVE-2024-23945.

Container imageDigestPackageFixed in
bde2020/hive:2.3.2-postgresql-metastore620267768985
hive-service@2.3.2
4.0.0
gradiant/hive:2.3.2-postgresql-metastoreaae4f8a21f8b
hive-service@2.3.2
4.0.0

Open the chart page →

20,837
hive-metastoreheva-helm-chartsVerified publisher0.2.01 of 2See more

hive-metastore heva-helm-charts 0.2.0

1 of the 2 container images this version deploys carry CVE-2024-23945.

Container imageDigestPackageFixed in
sslhep/hive-metastore:3.1.39e80af083079
hive-service@3.1.3
4.0.0

Open the chart page →

7,335
hive-metastoreslamdev0.0.51 of 2See more

hive-metastore slamdev 0.0.5

1 of the 2 container images this version deploys carry CVE-2024-23945.

Container imageDigestPackageFixed in
slamdev/apache-hive:2.3.9-2.10.1b4b029c9b15f
hive-service@2.3.9
4.0.0

Open the chart page →

8,198
apache-rangerapache-ranger0.1.01 of 2See more

apache-ranger apache-ranger 0.1.0

1 of the 2 container images this version deploys carry CVE-2024-23945.

Container imageDigestPackageFixed in
apache/ranger:2.7.076c176e8a0e4
hive-service@3.1.3
4.0.0

Open the chart page →

7,740
hive-metastoredmwm-bigdataVerified publisher0.1.31 of 2See more

hive-metastore dmwm-bigdata 0.1.3

1 of the 2 container images this version deploys carry CVE-2024-23945.

Container imageDigestPackageFixed in
bde2020/hive:2.3.2-postgresql-metastore620267768985
hive-service@2.3.2
4.0.0

Open the chart page →

6,882
stormgresearch1.2.01 of 3See more

storm gresearch 1.2.0

1 of the 3 container images this version deploys carry CVE-2024-23945.

Container imageDigestPackageFixed in
library/storm:2.4.0bd5d420506d6
hive-service@2.3.4
4.0.0

Open the chart page →

6,165
metabasemetabase-helmVerified publisher2.7.11 of 1See more

metabase metabase-helm 2.7.1

1 of the 1 container images this version deploys carry CVE-2024-23945.

Container imageDigestPackageFixed in
metabase/metabase:v0.46.09ebdc664a6b2
hive-service@3.1.3
4.0.0

Open the chart page →

2,221
metabasecasemark2.16.111 of 1See more

metabase casemark 2.16.11

1 of the 1 container images this version deploys carry CVE-2024-23945.

Container imageDigestPackageFixed in
cmosborn/metabase-arm64:0.50.286ec0a8878ad2
hive-service@3.1.3
4.0.0

Open the chart page →

1,215
spark-history-servercloudnativeapp1.0.01 of 3See more

spark-history-server cloudnativeapp 1.0.0

1 of the 3 container images this version deploys carry CVE-2024-23945.

Container imageDigestPackageFixed in
lightbend/spark-history-server:2.4.00bedf37f428a
spark-hive-thriftserver_2.11@2.4.0
no fix listed

Open the chart page →

14,066
spark-standalonedmwm-bigdataVerified publisher0.1.01 of 2See more

spark-standalone dmwm-bigdata 0.1.0

1 of the 2 container images this version deploys carry CVE-2024-23945.

Container imageDigestPackageFixed in
gradiant/spark:2.4.4-python-alpine97657d56e927
spark-hive-thriftserver_2.11@2.4.4
no fix listed

Open the chart page →

6,147
spark-shuffleduyet0.2.01 of 1See more

spark-shuffle duyet 0.2.0

1 of the 1 container images this version deploys carry CVE-2024-23945.

Container imageDigestPackageFixed in
snappydatainc/spark-shuffle:v2.2.0-kubernetes-0.5.1fd4b2070466f
spark-hive-thriftserver_2.11@2.2.0-k8s-0.5.0
no fix listed

Open the chart page →

5,639
hivegradiant-bigdataVerified publisher0.1.62 of 5See more

hive gradiant-bigdata 0.1.6

2 of the 5 container images this version deploys carry CVE-2024-23945.

Container imageDigestPackageFixed in
bde2020/hive:2.3.2-postgresql-metastore620267768985
hive-service@2.3.2
4.0.0
gradiant/hive:2.3.2-postgresql-metastoreaae4f8a21f8b
hive-service@2.3.2
4.0.0

Open the chart page →

20,837
hive-metastoregradiant-bigdataVerified publisher0.1.31 of 2See more

hive-metastore gradiant-bigdata 0.1.3

1 of the 2 container images this version deploys carry CVE-2024-23945.

Container imageDigestPackageFixed in
bde2020/hive:2.3.2-postgresql-metastore620267768985
hive-service@2.3.2
4.0.0

Open the chart page →

6,882
spark-standalonegradiant-bigdataVerified publisher0.1.01 of 2See more

spark-standalone gradiant-bigdata 0.1.0

1 of the 2 container images this version deploys carry CVE-2024-23945.

Container imageDigestPackageFixed in
gradiant/spark:2.4.4-python-alpine97657d56e927
spark-hive-thriftserver_2.11@2.4.4
no fix listed

Open the chart page →

6,147
metabasehelm-charts-nr0.14.41 of 1See more

metabase helm-charts-nr 0.14.4

1 of the 1 container images this version deploys carry CVE-2024-23945.

Container imageDigestPackageFixed in
metabase/metabase:v0.45.21fb334ce4820
hive-service@3.1.3
4.0.0

Open the chart page →

2,572

Container images carrying it

14 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
bde2020/hive:2.3.2-postgresql-metastore620267768985
hive-service@2.3.2
4.0.0
4
gradiant/hive:2.3.2-postgresql-metastoreaae4f8a21f8b
hive-service@2.3.2
4.0.0
2
gradiant/spark:2.4.4-python-alpine97657d56e927
spark-hive-thriftserver_2.11@2.4.4
no fix listed
2
metabase/metabase:v0.45.21fb334ce4820
hive-service@3.1.3
4.0.0
2
5200710/hive:3.1.3-postgresql-metastoree34ab066d2ed
hive-service@3.1.3
4.0.0
1
apache/ranger:2.7.076c176e8a0e4
hive-service@3.1.3
4.0.0
1
cmosborn/metabase-arm64:0.50.286ec0a8878ad2
hive-service@3.1.3
4.0.0
1
dbanda/livy:0.80ca125e68e53
spark-hive-thriftserver_2.11@2.2.0
no fix listed
1
library/storm:2.4.0bd5d420506d6
hive-service@2.3.4
4.0.0
1
lightbend/spark-history-server:2.4.00bedf37f428a
spark-hive-thriftserver_2.11@2.4.0
no fix listed
1
metabase/metabase:v0.46.09ebdc664a6b2
hive-service@3.1.3
4.0.0
1
slamdev/apache-hive:2.3.9-2.10.1b4b029c9b15f
hive-service@2.3.9
4.0.0
1
snappydatainc/spark-shuffle:v2.2.0-kubernetes-0.5.1fd4b2070466f
spark-hive-thriftserver_2.11@2.2.0-k8s-0.5.0
no fix listed
1
sslhep/hive-metastore:3.1.39e80af083079
hive-service@3.1.3
4.0.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.