Advisoriesby IbisApache HiveGHSA-gf2v-9hp6-44qg
Apache Hive: improper certificate validation
Fix: upgrade to 1.2.2 or later (2 fixed versions below)
Apache Hive (JDBC + HiveServer2) implements SSL for plain TCP and HTTP connections (it supports both transport modes). While validating the server's certificate during the connection setup, the client in Apache Hive before 1.2.2 and 2.0.x before 2.0.1 doesn't seem to be verifying the common name attribute of the certificate. In this way, if a JDBC client sends an SSL request to server abc.com, and the server responds with a valid certificate (certified by CA) but issued to xyz.com, the client will accept that as a valid certificate and the SSL handshake will go through.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.hive:hive-exec Maven | < 1.2.2 | 1.2.2 |
| >= 2.0.0, < 2.0.1 | 2.0.1 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-295
- Also known as
- CVE-2016-3083
More Apache Hive advisories
All Apache Hive
Improper Authentication in org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-serviceCVE-2015-1772fixed in 1.0.1 +1Apache Hive: information disclosureCVE-2017-12625fixed in 2.1.2 +2Improper Authentication in hive:hive-execCVE-2018-11777fixed in 2.3.4 +1Exposure of Sensitive Information to an Unauthorized Actor in Apache hiveCVE-2018-1284fixed in 2.3.3Incorrect Permission Assignment for Critical Resource in Apache hiveCVE-2018-1315fixed in 2.3.3Apache Hive: improper authenticationCVE-2015-7521fixed in 1.2.2