Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 15 Jul 2022 17:40:36 -0400
From: Naveen Gangam <>
To: security <>,,,
Subject: [Security] CVE-2021-34538: Security vulnerability in Hive with UDFs

*CVE-2021-34538*: Unauthorized access to Hive UDFs

*Severity*: Very Important

*Vendor*: The Apache Software Foundation

*Versions Affected*: This vulnerability affects all versions of Hive prior
to Hive 3.1.3. (3.1.2 or earlier).

*Version Fixed:* Hive 3.1.3, Hive 4.0 (in Beta)

*Description*: Hive's "CREATE" and "DROP" function operations does not
check for necessary authorization of involved entities in the query. It was
found that an unauthorized user can manipulate an existing UDF without
having the privileges to do so. This allowed unauthorized or
underprivileged users to drop and recreate UDFs pointing them to new jars
that could be potentially malicious.

Mitigation: This vulnerability has been addressed vio HIVE-25468 in Hive
3.1.3 release and will be included in Hive 4.0GA (Already in the beta
releases). Please upgrade to one of the releases containing the fix or
apply this patch to an existing release.

Credit: This vulnerability was discovered and reported by Hideyuki Furue.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.