CVE-2018-11777: Improper Authentication in org.apache.hive:hive-exec
Summary
CVE-2018-11777: Improper Authentication in hive:hive-exec. Affects org.apache.hive:hive-exec across 2 version ranges.
< 2.3.4
>= 3.0.0, < 3.1.1
Fixed in 2.3.4 or 3.1.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.apache.hive:hive-exec is a Maven package that provides execution functionality for Apache Hive, a data warehouse infrastructure built on top of Hadoop. It allows users to query and manage large datasets stored in distributed storage. This package is vulnerable to an improper authentication issue in versions 2.3.3, 3.1.0, and earlier. If ranger, sentry, or sql standard authorizer is not in use, local resources on HiveServer2 machines are not adequately protected against malicious users.
Vulnerability Detail
The vulnerability in org.apache.hive:hive-exec allows unauthorized access to local resources on HiveServer2 machines. This can lead to various malicious activities, such as unauthorized data access, data manipulation, or denial of service attacks. The issue arises when ranger, sentry, or sql standard authorizer is not implemented, leaving the system vulnerable to exploitation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.3.42.3.4 -
>= 3.0.0, < 3.1.13.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest versions is not feasible, a workaround is to implement ranger, sentry, or sql standard authorizer to ensure proper authentication and protection of local resources on HiveServer2 machines. This can be achieved by following the documentation and guidelines provided by Apache Hive.
Conclusion
In conclusion, org.apache.hive:hive-exec versions 2.3.3, 3.1.0, and earlier are vulnerable to an improper authentication issue. Upgrading to the recommended versions or implementing the suggested workarounds will mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.apache.hive:hive-exec →
FAQ
org.apache.hive:hive-exec is a Maven package that provides execution functionality for Apache Hive, a data warehouse infrastructure built on top of Hadoop.
The vulnerability allows unauthorized access to local resources on HiveServer2 machines, potentially leading to unauthorized data access, data manipulation, or denial of service attacks.
Versions 2.3.3, 3.1.0, and earlier are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to version 3.1.1 if using versions 3.0.0 and later. For versions 2.3.3 and earlier, upgrading to version 2.3.4 is advised.
Yes, a workaround is to implement ranger, sentry, or sql standard authorizer to ensure proper authentication and protection of local resources on HiveServer2 machines.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.hive:hive-exec.
