CVE-2017-12625: Apache Hive - Incorrect Policy Enforcement on Masked Columns
Summary
CVE-2017-12625: Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be defined on tables or views, e.g., using Apache Ranger. Affects org.apache.hive:hive across 3 version ranges.
>= 2.1.0, < 2.1.2
>= 2.2.0, < 2.2.1
>= 2.3.0, < 2.3.1
Fixed in 2.1.2, 2.2.1 or 2.3.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Hive is a data warehouse infrastructure built on top of Hadoop for providing data summarization, query, and analysis. It allows users to query and manage large datasets using a SQL-like language called HiveQL. The affected packages, org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service, are integral components of Apache Hive.
Vulnerability Detail
Apache Hive versions 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 suffer from a moderate severity vulnerability. This vulnerability exposes an interface through which masking policies can be defined on tables or views, typically using Apache Ranger. However, when a view is created over a table, the policy enforcement does not occur correctly on the table for masked columns. This flaw can potentially lead to unauthorized access to sensitive data.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.1.0, < 2.1.22.1.2 -
>= 2.2.0, < 2.2.12.2.1 -
>= 2.3.0, < 2.3.12.3.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is advised to upgrade to the fixed versions as soon as possible.
Conclusion
Apache Hive versions 2.1.x, 2.2.x, and 2.3.x suffer from a vulnerability that allows unauthorized access to sensitive data. It is crucial to upgrade to the fixed versions (2.1.2, 2.2.1, or 2.3.1) to ensure proper policy enforcement on masked columns. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.apache.hive:hive →
FAQ
Apache Hive is a data warehouse infrastructure built on top of Hadoop for providing data summarization, query, and analysis.
The affected packages are org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service.
This vulnerability can potentially lead to unauthorized access to sensitive data.
No, there are no known workarounds for this vulnerability. It is recommended to upgrade to the fixed versions.
To fix this vulnerability, upgrade to Apache Hive versions 2.1.2, 2.2.1, or 2.3.1, depending on the affected package.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.hive:hive.
