oss-sec mailing list archives
[Security] CVE-2021-34538: Security vulnerability in Hive with UDFs
From: Naveen Gangam <ngangam () cloudera com>
Date: Fri, 15 Jul 2022 17:40:36 -0400
*CVE-2021-34538*: Unauthorized access to Hive UDFs *Severity*: Very Important *Vendor*: The Apache Software Foundation *Versions Affected*: This vulnerability affects all versions of Hive prior to Hive 3.1.3. (3.1.2 or earlier). *Version Fixed:* Hive 3.1.3, Hive 4.0 (in Beta) *Description*: Hive's "CREATE" and "DROP" function operations does not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged users to drop and recreate UDFs pointing them to new jars that could be potentially malicious. Mitigation: This vulnerability has been addressed vio HIVE-25468 in Hive 3.1.3 release and will be included in Hive 4.0GA (Already in the beta releases). Please upgrade to one of the releases containing the fix or apply this patch to an existing release. Credit: This vulnerability was discovered and reported by Hideyuki Furue. THANK YOU !!!
Current thread:
- [Security] CVE-2021-34538: Security vulnerability in Hive with UDFs Naveen Gangam (Jul 15)