Apache HiveGHSA-rxmr-c9jm-7mm8

Exposure of Sensitive Information to an Unauthorized Actor in Apache hive

Low3.7CVE-2018-1284 · Published Nov 21, 2018 · updated Mar 4, 2024

Affected versions

Package	Affected	Fixed in
org.apache.hive:hive-exec Maven	>= 0.6.0, < 2.3.3	2.3.3

Details and references

In Apache Hive 0.6.0 to 2.3.2, malicious user might use any xpath UDFs (xpath/xpath_string/xpath_boolean/xpath_number/xpath_double/xpath_float/xpath_long/xpath_int/xpath_short) to expose the content of a file on the machine running HiveServer2 owned by HiveServer2 user (usually hive) if hive.server2.enable.doAs=false.

CVSS 3.0: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Severity from: GitHub (reviewed advisory)
Weakness: CWE-200
Also known as: CVE-2018-1284

More Apache Hive advisories

All Apache Hive

Date	Advisory	Severity	Fixed in
Nov 212018	Low severity vulnerability that affects org.apache.hive:hive-exec, org.apache.hive:hive, and org.apache.hive:hive-service CVE-2014-0228Lowfixed in 0.13.1	Low	0.13.1
Nov 212018	High severity vulnerability that affects org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service CVE-2015-7521High8.3fixed in 1.2.2	High8.3	1.2.2
Nov 212018	Incorrect Permission Assignment for Critical Resource in Apache hive CVE-2018-1315Low3.7fixed in 2.3.3	Low3.7	2.3.3
Nov 212018	Improper Authentication in hive:hive-exec CVE-2018-11777High8.1fixed in 2.3.4, 3.1.1	High8.1	2.3.4, 3.1.1
Mar 142019	Moderate severity vulnerability that affects org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service CVE-2017-12625Medium4.3fixed in 2.1.2, 2.2.1, 2.3.1	Medium4.3	2.1.2, 2.2.1, 2.3.1
Mar 142019	org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service vulnerable to Improper Certificate Validation CVE-2016-3083High7.5fixed in 1.2.2, 2.0.1	High7.5	1.2.2, 2.0.1

Affected versions

More Apache Hive advisories

Critical advisories by email