Apache HiveGHSA-gf2v-9hp6-44qg
Apache Hive: improper certificate validation
High7.5CVE-2016-3083 · Published Mar 14, 2019 · updated Nov 8, 2023
Apache Hive (JDBC + HiveServer2) implements SSL for plain TCP and HTTP connections (it supports both transport modes). While validating the server's certificate during the connection setup, the client in Apache Hive before 1.2.2 and 2.0.x before 2.0.1 doesn't seem to be verifying the common name attribute of the certificate. In this way, if a JDBC client sends an SSL request to server abc.com, and the server responds with a valid certificate (certified by CA) but issued to xyz.com, the client will accept that as a valid certificate and the SSL handshake will go through.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.hive:hive-exec Maven | < 1.2.2 | 1.2.2 |
| >= 2.0.0, < 2.0.1 | 2.0.1 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-295
- Also known as
- CVE-2016-3083
More Apache Hive advisories
All Apache Hive| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 142019 | Improper Authentication in org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service High7.3Mar 14, 2019 | High7.3 | 1.0.1+1 more |
| Mar 142019 | Apache Hive: information disclosureMedium4.3Mar 14, 2019 | Medium4.3 | 2.1.2+2 more |
| Nov 212018 | Improper Authentication in hive:hive-execHigh8.1Nov 21, 2018 | High8.1 | 2.3.4+1 more |
| Nov 212018 | Exposure of Sensitive Information to an Unauthorized Actor in Apache hiveLow3.7Nov 21, 2018 | Low3.7 | 2.3.3 |
| Nov 212018 | Incorrect Permission Assignment for Critical Resource in Apache hiveLow3.7Nov 21, 2018 | Low3.7 | 2.3.3 |
| Nov 212018 | Apache Hive: improper authenticationHigh8.3Nov 21, 2018 | High8.3 | 1.2.2 |