Advisoriesby IbisApache HiveGHSA-2g9q-chq2-w8qw
Apache Hive: information disclosure
Fix: upgrade to 2.1.2 or later (3 fixed versions below)
Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be defined on tables or views, e.g., using Apache Ranger. When a view is created over a given table, the policy enforcement does not happen correctly on the table for masked columns.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.hive:hive-exec Maven | >= 2.1.0, < 2.1.2 | 2.1.2 |
| >= 2.2.0, < 2.2.1 | 2.2.1 | |
| >= 2.3.0, < 2.3.1 | 2.3.1 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-200
- Also known as
- CVE-2017-12625
More Apache Hive advisories
All Apache Hive
Improper Authentication in org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-serviceCVE-2015-1772fixed in 1.0.1 +1Apache Hive: improper certificate validationCVE-2016-3083fixed in 1.2.2 +1Improper Authentication in hive:hive-execCVE-2018-11777fixed in 2.3.4 +1Exposure of Sensitive Information to an Unauthorized Actor in Apache hiveCVE-2018-1284fixed in 2.3.3Incorrect Permission Assignment for Critical Resource in Apache hiveCVE-2018-1315fixed in 2.3.3Apache Hive: improper authenticationCVE-2015-7521fixed in 1.2.2