CVE-2016-3083: Improper Certificate Validation in org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service
Summary
CVE-2016-3083: Apache Hive (JDBC + HiveServer2) implements SSL for plain TCP and HTTP connections (it supports both transport modes). Affects org.apache.hive:hive across 2 version ranges.
< 1.2.2
>= 2.0.0, < 2.0.1
Fixed in 1.2.2 or 2.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Hive is a data warehouse infrastructure built on top of Hadoop for providing data summarization, query, and analysis. It includes components such as HiveServer2 and HiveExecutor for executing queries and managing connections. These components implement SSL for secure communication. However, prior to versions 1.2.2 and 2.0.1, Apache Hive did not properly validate the server's certificate during the SSL handshake. This means that if a JDBC client sends an SSL request to a server with a different common name attribute in its certificate, the client will accept the certificate as valid.
Vulnerability Detail
The vulnerability in Apache Hive allows for improper certificate validation during the SSL handshake. This means that an attacker could potentially perform a man-in-the-middle attack by presenting a valid certificate issued to a different domain. The client would accept this certificate as valid, allowing the attacker to intercept and manipulate the SSL communication. This could lead to unauthorized access, data leakage, or other security breaches.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.2.21.2.2 -
>= 2.0.0, < 2.0.12.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of Apache Hive.
Conclusion
In conclusion, the vulnerability in Apache Hive allows for improper certificate validation during the SSL handshake, potentially enabling man-in-the-middle attacks. To mitigate this risk, it is recommended to upgrade to Apache Hive version 1.2.2 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.hive:hive →
FAQ
Apache Hive is a data warehouse infrastructure built on top of Hadoop for providing data summarization, query, and analysis.
This vulnerability allows for improper certificate validation during the SSL handshake, potentially enabling man-in-the-middle attacks and unauthorized access to SSL communication.
To fix this vulnerability, it is recommended to upgrade to Apache Hive version 1.2.2 or later.
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of Apache Hive.
You can find more information about this vulnerability in the Apache Hive advisory database.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.hive:hive.
