CVE-2018-1314: Apache Hive JDBC 'EXPLAIN' Operation Authorization Bypass
Summary
CVE-2018-1314: Moderate severity vulnerability that affects org.apache.hive:hive-jdbc. Affects org.apache.hive:hive-jdbc across 2 version ranges.
< 2.3.4
>= 3.0.0, < 3.1.1
Fixed in 2.3.4 or 3.1.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Hive is a data warehouse infrastructure built on top of Apache Hadoop for providing data summarization, query, and analysis. It includes a JDBC driver, org.apache.hive:hive-jdbc, which allows applications to connect to Hive and execute SQL-like queries. However, versions 2.3.3, 3.1.0, and earlier of Hive JDBC are vulnerable to an authorization bypass issue in the 'EXPLAIN' operation.
Vulnerability Detail
The 'EXPLAIN' operation in Apache Hive allows users to retrieve metadata and statistics about a query execution plan. However, prior to versions 2.3.4 and 3.1.1, Hive did not properly check for necessary authorization of the entities involved in the query. This means that an unauthorized user could perform an 'EXPLAIN' operation on any table or view, potentially exposing sensitive table metadata and statistics.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.3.42.3.4 -
>= 3.0.0, < 3.1.13.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability.
Conclusion
In conclusion, the Apache Hive JDBC 'EXPLAIN' operation authorization bypass vulnerability allows unauthorized users to retrieve sensitive table metadata and statistics. It is recommended to upgrade to a fixed version of the org.apache.hive:hive-jdbc package to mitigate this issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.hive:hive-jdbc →
FAQ
Apache Hive is a data warehouse infrastructure built on top of Apache Hadoop for providing data summarization, query, and analysis.
The 'EXPLAIN' operation in Hive allows users to retrieve metadata and statistics about a query execution plan.
Versions 2.3.3, 3.1.0, and earlier of Hive JDBC are affected by this vulnerability.
An unauthorized user can perform an 'EXPLAIN' operation on any table or view, potentially exposing sensitive table metadata and statistics.
To fix this vulnerability, upgrade to a fixed version of the org.apache.hive:hive-jdbc package (2.3.4 or later for versions 2.3.3 and earlier, 3.1.1 or later for versions 3.1.0 and earlier).
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.hive:hive-jdbc.
