Advisoriesby IbisApache HiveGHSA-5gvm-hrw5-h6xf
Improper Authentication in org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service
Fix: upgrade to 1.0.1 or later (2 fixed versions below)
The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, mishandles simple unauthenticated and anonymous bind configurations, which allows remote attackers to bypass authentication via a crafted LDAP request.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.hive:hive-exec Maven | >= 1.0.0, < 1.0.1 | 1.0.1 |
| >= 1.1.0, < 1.1.1 | 1.1.1 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-287
- Also known as
- CVE-2015-1772
- nvd.nist.gov/vuln/detail/CVE-2015-1772
- github.com/advisories/GHSA-5gvm-hrw5-h6xf
- www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html
- mail-archives.apache.org/mod_mbox/www-announce/201505.mbox/%3CCAOpgucy52yzNN1FaRcxwhZmx8ZtNRjmK6V0Bxk4svAD-R1q70Q@mail.gmail.com%3E
- www-01.ibm.com/support/docview.wss?uid=swg21969546
- www.securitytracker.com/id/1034365
More Apache Hive advisories
All Apache Hive
Apache Hive: improper certificate validationCVE-2016-3083fixed in 1.2.2 +1Apache Hive: information disclosureCVE-2017-12625fixed in 2.1.2 +2Improper Authentication in hive:hive-execCVE-2018-11777fixed in 2.3.4 +1Exposure of Sensitive Information to an Unauthorized Actor in Apache hiveCVE-2018-1284fixed in 2.3.3Incorrect Permission Assignment for Critical Resource in Apache hiveCVE-2018-1315fixed in 2.3.3Apache Hive: improper authenticationCVE-2015-7521fixed in 1.2.2