CVE-2015-7521

El marco de autorización en Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 y 1.2.1 en clusters protegidos por Ranger y SqlStdHiveAuthorization, permite a atacantes eludir las restricciones de acceso de tabla padre previstas a través de operaciones a nivel partición no especificadas.

Some partition-level operations exist that do not explicitly also authorize privileges of the parent table. This can lead to issues when the parent table would have denied the operation, but no denial occurs because the partition-level privilege is not checked by the authorization framework, which defines authorization entities only from the table level upwards. This issue is known to affect Hive clusters protected by both Ranger as well as SqlStdHiveAuthorization. Apache Hive versions 1.0.0 through 1.0.1, 1.1.0 through 1.1.1, and 1.2.0 through 1.2.1 are affected.