High · 8.3 CVE-2015-7521 EUVD-2018-0737GHSA-83r3-c79w-f6wc

High severity vulnerability that affects org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service

Published Jan 29, 2016 · Updated Aug 6, 2024 · Assigned by redhat

Package: org.apache.hive:hive Package: org.apache.hive:hive-exec Package: org.apache.hive:hive-service Ecosystem: Maven

Description

The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1, on clusters protected by Ranger and SqlStdHiveAuthorization, allows attackers to bypass intended parent table access restrictions via unspecified partition-level operations.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.apache.hive:hive	>= 1.0.0, < 1.2.2	1.2.2	GHSA-83r3-c79w-f6wc
Maven	org.apache.hive:hive-exec	>= 1.0.0, < 1.2.2	1.2.2	GHSA-83r3-c79w-f6wc
Maven	org.apache.hive:hive-service	>= 1.0.0, < 1.2.2	1.2.2	GHSA-83r3-c79w-f6wc

References

[oss-security] 20160128 CVE-2015-7521: Apache Hive authorization bug disclosure mailing-list
20160218 CVE-2015-7521: Apache Hive authorization bug disclosure (update) mailing-list
http://packetstormsecurity.com/files/135836/Apache-Hive-Authorization-Bypass.html
[hive-user] 20160128 CVE-2015-7521: Apache Hive authorization bug disclosure mailing-list