[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CADx9buP8OWYN2zjjhHmatNvsVPwpii6ic7Dw437BP7COe8NUKQ@mail.gmail.com>
Date: Fri, 15 Jul 2022 17:40:36 -0400
From: Naveen Gangam <ngangam@...udera.com>
To: security <security@...e.apache.org>, dev@...e.apache.org, user@...e.apache.org,
oss-security@...ts.openwall.com
Subject: [Security] CVE-2021-34538: Security vulnerability in Hive with UDFs
*CVE-2021-34538*: Unauthorized access to Hive UDFs
*Severity*: Very Important
*Vendor*: The Apache Software Foundation
*Versions Affected*: This vulnerability affects all versions of Hive prior
to Hive 3.1.3. (3.1.2 or earlier).
*Version Fixed:* Hive 3.1.3, Hive 4.0 (in Beta)
*Description*: Hive's "CREATE" and "DROP" function operations does not
check for necessary authorization of involved entities in the query. It was
found that an unauthorized user can manipulate an existing UDF without
having the privileges to do so. This allowed unauthorized or
underprivileged users to drop and recreate UDFs pointing them to new jars
that could be potentially malicious.
Mitigation: This vulnerability has been addressed vio HIVE-25468 in Hive
3.1.3 release and will be included in Hive 4.0GA (Already in the beta
releases). Please upgrade to one of the releases containing the fix or
apply this patch to an existing release.
Credit: This vulnerability was discovered and reported by Hideyuki Furue.
THANK YOU !!!
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
