Advisoriesby IbisApache HiveGHSA-c476-j253-5rgq
Apache Hive Incorrectly Assigns Permissions for a Critical Resource
Fix: upgrade to 4.0.1 or later
Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly. Any unauthorized user having access to the directory can read the sensitive information written into this file. Users are recommended to upgrade to version 4.0.1, which fixes this issue.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.hive:hive-exec Maven | < 4.0.1 | 4.0.1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-732
- Also known as
- CVE-2024-29869
More Apache Hive advisories
All Apache Hive
Apache Hive: Deserialization of untrusted data when fetching partitions from the MetastoreCVE-2022-41137fixed in 4.0.0-alpha-2Improper Authentication in org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-serviceCVE-2015-1772fixed in 1.0.1 +1Apache Hive: improper certificate validationCVE-2016-3083fixed in 1.2.2 +1Apache Hive: information disclosureCVE-2017-12625fixed in 2.1.2 +2Improper Authentication in hive:hive-execCVE-2018-11777fixed in 2.3.4 +1Exposure of Sensitive Information to an Unauthorized Actor in Apache hiveCVE-2018-1284fixed in 2.3.3