Advisoriesby IbisApache HiveGHSA-rrfq-g5fq-fc9c
Improper Authentication in hive:hive-exec
Fix: upgrade to 2.3.4 or later (2 fixed versions below)
In Apache Hive 2.3.3, 3.1.0 and earlier, local resources on HiveServer2 machines are not properly protected against malicious user if ranger, sentry or sql standard authorizer is not in use.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.hive:hive-exec Maven | >= 3.0.0, < 3.1.1 | 3.1.1 |
| < 2.3.4 | 2.3.4 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Severity from
- GitHub (reviewed advisory)
- Also known as
- CVE-2018-11777
More Apache Hive advisories
All Apache Hive
Apache Hive: improper certificate validationCVE-2016-3083fixed in 1.2.2 +1Apache Hive: information disclosureCVE-2017-12625fixed in 2.1.2 +2Exposure of Sensitive Information to an Unauthorized Actor in Apache hiveCVE-2018-1284fixed in 2.3.3Incorrect Permission Assignment for Critical Resource in Apache hiveCVE-2018-1315fixed in 2.3.3Apache Hive: improper authenticationCVE-2015-7521fixed in 1.2.2Apache Hive: information disclosureCVE-2014-0228fixed in 0.13.1