CVE-2014-0228: Apache Hive SQL Standards Based Authorization Mode File Permissions Vulnerability
Summary
CVE-2014-0228: Apache Hive before 0.13.1, when in SQL standards based authorization mode, does not properly check the file permissions for (1) import and (2) export statements, which allows remote authenticated users to obtain sensitiv... Affects org.apache.hive:hive versions < 0.13.1. Fixed in 0.13.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Hive is a data warehouse infrastructure built on top of Hadoop for providing data summarization, query, and analysis. It allows users to query and manage large datasets stored in distributed storage. The affected packages, org.apache.hive:hive-exec, org.apache.hive:hive, and org.apache.hive:hive-service, are components of Apache Hive.
Vulnerability Detail
Apache Hive before version 0.13.1, when in SQL standards based authorization mode, has a vulnerability that allows remote authenticated users to obtain sensitive information. This vulnerability arises due to improper file permission checks for import and export statements. An attacker can exploit this vulnerability by crafting a URI to access sensitive information.
How To Fix
Minimum fixed version
0.13.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is advised to upgrade to the fixed version as soon as possible.
Conclusion
The vulnerability in Apache Hive allows remote authenticated users to obtain sensitive information by exploiting improper file permission checks. It is crucial to upgrade to Apache Hive version 0.13.1 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.hive:hive →
FAQ
Apache Hive is a data warehouse infrastructure built on top of Hadoop for providing data summarization, query, and analysis.
This vulnerability allows remote authenticated users to obtain sensitive information by exploiting improper file permission checks in Apache Hive.
To fix this vulnerability, upgrade to Apache Hive version 0.13.1 or later.
There is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
You can find more information about this vulnerability in the Apache Hive advisory: [link to advisory]
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.hive:hive.
