Unscored CVE-2016-0760 EUVD-2016-0779GHSA-96hh-jjvq-5j5w

Multiple incomplete blacklist vulnerabilities in Apache Sentry before 1.7.0 allow remote authenticated users to execute arbitrary code via …

Published Aug 19, 2016 · Updated Aug 5, 2024 · Assigned by redhat

Description

Multiple incomplete blacklist vulnerabilities in Apache Sentry before 1.7.0 allow remote authenticated users to execute arbitrary code via the (1) reflect, (2) reflect2, or (3) java_method Hive builtin functions.

References

[sentry-dev] 20160804 CVE-2016-0760: Hive builtin functions "reflect", "reflect2", and "java_method" are not blocked in Apache Sentry mailing-list
92328 vdb-entry