CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-34538 – Apache Hive Security vulnerability in Hive with UDFs
https://notcve.org/view.php?id=CVE-2021-34538
Apache Hive before 3.1.3 "CREATE" and "DROP" function operations does not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged users to drop and recreate UDFs pointing them to new jars that could be potentially malicious. Las operaciones de función "CREATE" y "DROP" de Apache Hive versiones anteriores a 3.1.3, no comprueban la autorización necesaria de las entidades implicadas en la consulta. Se ha encontrado que un usuario no autorizado puede manipular una UDF existente sin tener los privilegios para hacerlo. • https://lists.apache.org/thread/oqqgnhz4c6nxsfd0xstosnk0g15f7354 • CWE-306: Missing Authentication for Critical Function •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2020-1926 – Timing attack in Cookie signature verification
https://notcve.org/view.php?id=CVE-2020-1926
Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks. This could allow recovery of another users cookie signature. The issue was addressed in Apache Hive 2.3.8 Una verificación de firma de cookies de Apache Hive, usó una comparación de tiempo no constante que se sabe que es vulnerable a los ataques de tiempo. Esto podría permitir una recuperación de la firma de cookies de otros usuarios. El problema se solucionó en Apache Hive versión 2.3.8 • https://issues.apache.org/jira/browse/HIVE-22708 https://lists.apache.org/thread.html/rd186eedff68102ba1e68059a808101c5aa587e11542c7dcd26e7b9d7%40%3Cuser.hive.apache.org%3E • CWE-203: Observable Discrepancy CWE-208: Observable Timing Discrepancy •
CVSS: 7.5EPSS: 5%CPEs: 4EXPL: 0CVE-2020-13949 – libthrift: potential DoS when processing untrusted payloads
https://notcve.org/view.php?id=CVE-2020-13949
In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. En Apache Thrift versiones 0.9.3 hasta 0.13.0, los clientes RPC maliciosos podrían enviar mensajes cortos que resultarían en una gran asignación de memoria, conllevando potencialmente a una denegación de servicio A flaw was found in libthrift. Applications using Thrift would not show an error upon receiving messages declaring containers of sizes larger than the payload. This results in malicious RPC clients with the ability to send short messages which would result in a large memory allocation, potentially leading to denial of service. The highest threat from this vulnerability is to system availability. • https://lists.apache.org/thread.html/r01b34416677f1ba869525e1b891ac66fa6f88c024ee4d7cdea6b456b%40%3Cissues.hbase.apache.org%3E https://lists.apache.org/thread.html/r02ba8db500d15a5949e9a7742815438002ba1cf1b361bdda52ed40ca%40%3Cissues.hbase.apache.org%3E https://lists.apache.org/thread.html/r02f7771863383ae993eb83cdfb70c3cb65a355c913242c850f61f1b8%40%3Cissues.hbase.apache.org%3E https://lists.apache.org/thread.html/r0372f0af2dad0b76fbd7a6cfdaad29d50384ad48dda475a5026ff9a3%40%3Cissues.hbase.apache.org%3E https://lists.apache.org/thread.html/r08a7bd19470ef8950d58cc9d9e7b02bc69c43f56c601989a7729cce5%4 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2018-11777
https://notcve.org/view.php?id=CVE-2018-11777
In Apache Hive 2.3.3, 3.1.0 and earlier, local resources on HiveServer2 machines are not properly protected against malicious user if ranger, sentry or sql standard authorizer is not in use. En Apache Hive en sus versiones 2.3.3, 3.1.0 y anteriores, los recursos locales de las máquinas HiveServer2 no están protegidos adecuadamente contra usuarios maliciosos si no se está utilizando ranger, sentry o sql standard authorizer. • http://www.securityfocus.com/bid/105886 https://lists.apache.org/thread.html/963c8e2516405c9b532b4add16c03b2c5db621e0c83e80f45049cbbb%40%3Cdev.hive.apache.org%3E •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2018-1314
https://notcve.org/view.php?id=CVE-2018-1314
In Apache Hive 2.3.3, 3.1.0 and earlier, Hive "EXPLAIN" operation does not check for necessary authorization of involved entities in a query. An unauthorized user can do "EXPLAIN" on arbitrary table or view and expose table metadata and statistics. En Apache Hive en sus versiones 2.3.3, 3.1.0 y anteriores, la operación "EXPLAIN" de Hive no comprueba la autorización necesaria de las entidades implicadas en una consulta. Un usuario no autorizado puede hacer "EXPLAIN" en una tabla o vista arbitrarias y exponer los metadatos y estadísticas de la tabla. • http://www.securityfocus.com/bid/105884 https://lists.apache.org/thread.html/3da47dbcbf09697387f29d2f1aed970523b6b334d93afd3cced23727%40%3Cdev.hive.apache.org%3E • CWE-862: Missing Authorization •