CVE-2015-1772: Improper Authentication in org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service
Summary
CVE-2015-1772: The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, mishandles simple unauthenticated and anonymo... Affects org.apache.hive:hive across 2 version ranges.
>= 1.0.0, < 1.0.1
>= 1.1.0, < 1.1.1
Fixed in 1.0.1 or 1.1.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Apache Hive project provides data warehouse infrastructure on top of Hadoop, allowing users to query and analyze large datasets. The affected packages, org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service, are components of HiveServer2, which is used for remote access to Hive. These packages are used in various products, including IBM InfoSphere BigInsights. The vulnerability in question relates to the LDAP implementation in HiveServer2.
Vulnerability Detail
The LDAP implementation in HiveServer2 mishandles simple unauthenticated and anonymous bind configurations. This flaw allows remote attackers to bypass authentication by sending a crafted LDAP request. As a result, unauthorized users can gain access to the system and perform unauthorized actions. The vulnerability has a CVSS score of 7.3, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 1.0.11.0.1 -
>= 1.1.0, < 1.1.11.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to apply the fix by upgrading to the recommended versions.
Conclusion
The vulnerability in the LDAP implementation of HiveServer2 can allow remote attackers to bypass authentication and gain unauthorized access to the system. It is crucial to upgrade to the fixed versions of the affected packages to mitigate this vulnerability. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.hive:hive →
FAQ
The vulnerability allows remote attackers to bypass authentication, potentially leading to unauthorized access and unauthorized actions on the system.
The vulnerability affects versions of Apache Hive before 1.0.1 and 1.1.x before 1.1.1.
There are no known public exploits available for this vulnerability at the time of this report.
Yes, the CVSS score for this vulnerability is 7.3, indicating a high severity level.
You can find more information about the vulnerability in the GitHub advisory database. Please refer to the provided source links for detailed information.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.hive:hive.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
