PT-2017-8326 · Apache · Apache Hive

Branden Crawford · Publicado 2017-05-30 · Atualizado 2019-03-14 · CVE-2016-3083

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Hive versions prior to 1.2.2 Apache Hive versions 2.0.x prior to 2.0.1

Description The issue arises during the validation of the server's certificate in the connection setup. The client fails to verify the common name attribute of the certificate. This allows a scenario where a JDBC client sending an SSL request to a server, for example, abc.com, will accept a valid certificate issued to a different domain, such as xyz.com, as long as it is certified by a CA. This compromises the security of the SSL handshake.

Recommendations For Apache Hive versions prior to 1.2.2, update to version 1.2.2 or later to resolve the issue. For Apache Hive versions 2.0.x prior to 2.0.1, update to version 2.0.1 or later to resolve the issue.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2016-3083

GHSA-GF2V-9HP6-44QG

Produtos afetados

Apache Hive

Referências · 7

• https://lists.apache.org/thread.html/0851bcf85635385f94cdaa008053802d92b4aab0a3075e30ed171192%40%3Cdev.hive.apache.org%3E · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-3083 · Nota de Segurança
• https://github.com/advisories/GHSA-gf2v-9hp6-44qg · Nota
• http://securityfocus.com/bid/98669 · Nota
• https://lists.apache.org/thread.html/0851bcf85635385f94cdaa008053802d92b4aab0a3075e30ed171192@%3Cdev.hive.apache.org%3E · Nota
• https://osv.dev/vulnerability/CVE-2016-3083 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-gf2v-9hp6-44qg · Aviso do Fabricante