CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-34538 – Apache Hive Security vulnerability in Hive with UDFs
https://notcve.org/view.php?id=CVE-2021-34538
Apache Hive before 3.1.3 "CREATE" and "DROP" function operations does not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged users to drop and recreate UDFs pointing them to new jars that could be potentially malicious. Las operaciones de función "CREATE" y "DROP" de Apache Hive versiones anteriores a 3.1.3, no comprueban la autorización necesaria de las entidades implicadas en la consulta. Se ha encontrado que un usuario no autorizado puede manipular una UDF existente sin tener los privilegios para hacerlo. • https://lists.apache.org/thread/oqqgnhz4c6nxsfd0xstosnk0g15f7354 • CWE-306: Missing Authentication for Critical Function •
CVSS: 7.5EPSS: 5%CPEs: 4EXPL: 0CVE-2020-13949 – libthrift: potential DoS when processing untrusted payloads
https://notcve.org/view.php?id=CVE-2020-13949
In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. En Apache Thrift versiones 0.9.3 hasta 0.13.0, los clientes RPC maliciosos podrían enviar mensajes cortos que resultarían en una gran asignación de memoria, conllevando potencialmente a una denegación de servicio A flaw was found in libthrift. Applications using Thrift would not show an error upon receiving messages declaring containers of sizes larger than the payload. This results in malicious RPC clients with the ability to send short messages which would result in a large memory allocation, potentially leading to denial of service. The highest threat from this vulnerability is to system availability. • https://lists.apache.org/thread.html/r01b34416677f1ba869525e1b891ac66fa6f88c024ee4d7cdea6b456b%40%3Cissues.hbase.apache.org%3E https://lists.apache.org/thread.html/r02ba8db500d15a5949e9a7742815438002ba1cf1b361bdda52ed40ca%40%3Cissues.hbase.apache.org%3E https://lists.apache.org/thread.html/r02f7771863383ae993eb83cdfb70c3cb65a355c913242c850f61f1b8%40%3Cissues.hbase.apache.org%3E https://lists.apache.org/thread.html/r0372f0af2dad0b76fbd7a6cfdaad29d50384ad48dda475a5026ff9a3%40%3Cissues.hbase.apache.org%3E https://lists.apache.org/thread.html/r08a7bd19470ef8950d58cc9d9e7b02bc69c43f56c601989a7729cce5%4 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2018-11777
https://notcve.org/view.php?id=CVE-2018-11777
In Apache Hive 2.3.3, 3.1.0 and earlier, local resources on HiveServer2 machines are not properly protected against malicious user if ranger, sentry or sql standard authorizer is not in use. En Apache Hive en sus versiones 2.3.3, 3.1.0 y anteriores, los recursos locales de las máquinas HiveServer2 no están protegidos adecuadamente contra usuarios maliciosos si no se está utilizando ranger, sentry o sql standard authorizer. • http://www.securityfocus.com/bid/105886 https://lists.apache.org/thread.html/963c8e2516405c9b532b4add16c03b2c5db621e0c83e80f45049cbbb%40%3Cdev.hive.apache.org%3E •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2018-1314
https://notcve.org/view.php?id=CVE-2018-1314
In Apache Hive 2.3.3, 3.1.0 and earlier, Hive "EXPLAIN" operation does not check for necessary authorization of involved entities in a query. An unauthorized user can do "EXPLAIN" on arbitrary table or view and expose table metadata and statistics. En Apache Hive en sus versiones 2.3.3, 3.1.0 y anteriores, la operación "EXPLAIN" de Hive no comprueba la autorización necesaria de las entidades implicadas en una consulta. Un usuario no autorizado puede hacer "EXPLAIN" en una tabla o vista arbitrarias y exponer los metadatos y estadísticas de la tabla. • http://www.securityfocus.com/bid/105884 https://lists.apache.org/thread.html/3da47dbcbf09697387f29d2f1aed970523b6b334d93afd3cced23727%40%3Cdev.hive.apache.org%3E • CWE-862: Missing Authorization •