CVE-2018-1284: Apache Hive - Exposure of Sensitive Information
Summary
CVE-2018-1284: Exposure of Sensitive Information to an Unauthorized Actor in Apache hive. Affects org.apache.hive:hive versions >= 0.6.0, < 2.3.3. Fixed in 2.3.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Hive is a data warehouse infrastructure built on top of Apache Hadoop for querying and analyzing large datasets stored in Hadoop Distributed File System (HDFS). It provides a SQL-like interface to query and manage data. HiveServer2 is the server component of Apache Hive that allows clients to submit queries and interact with Hive. The vulnerability identified as CVE-2018-1284 affects versions 0.6.0 to 2.3.2 of Apache Hive.
Vulnerability Detail
The vulnerability allows a malicious user to exploit certain XPath UDFs (User-Defined Functions) in Apache Hive to expose the content of a file on the machine running HiveServer2. This file is owned by the HiveServer2 user, typically 'hive'. The vulnerability can be exploited when the configuration parameter 'hive.server2.enable.doAs' is set to 'false'. The impact of this vulnerability is the unauthorized disclosure of sensitive information stored on the machine running HiveServer2.
How To Fix
Minimum fixed version
2.3.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can set the 'hive.server2.enable.doAs' configuration parameter to 'true'. This will enable impersonation, ensuring that the file access is restricted to the authorized user. However, this workaround may have implications on the overall system performance and should be used cautiously.
Conclusion
The vulnerability in Apache Hive (CVE-2018-1284) exposes sensitive information to unauthorized actors. It is crucial to upgrade to Apache Hive version 2.3.3 or later to mitigate this vulnerability. Alternatively, users can apply the temporary workaround of setting 'hive.server2.enable.doAs' to 'true', but this may have performance implications. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.hive:hive →
FAQ
Apache Hive is a data warehouse infrastructure built on top of Apache Hadoop for querying and analyzing large datasets stored in HDFS.
HiveServer2 is the server component of Apache Hive that allows clients to submit queries and interact with Hive.
The vulnerability allows unauthorized access to sensitive information stored on the machine running HiveServer2.
To fix this vulnerability, it is recommended to upgrade to Apache Hive version 2.3.3 or later.
Yes, a temporary workaround is to set the 'hive.server2.enable.doAs' configuration parameter to 'true'. However, this may impact system performance.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.hive:hive.
