PT-2023-12360 · Apache · Apache Ranger Hive Plugin

Ramesh Mani · Publicado 2023-05-05 · Atualizado 2024-10-11 · CVE-2021-40331

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Ranger Hive Plugin versions 2.0.0 through 2.3.0

Description An Incorrect Permission Assignment for Critical Resource issue was found in the Apache Ranger Hive Plugin. Any user with SELECT privilege on a database can alter the ownership of the table in Hive when Apache Ranger Hive Plugin is enabled.

Recommendations For Apache Ranger Hive Plugin versions 2.0.0 through 2.3.0, upgrade to version 2.4.0 or later to resolve the issue. As a temporary workaround, consider restricting the SELECT privilege on databases to minimize the risk of exploitation.

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2021-40331

GHSA-VJR2-WPFH-5R9P

Produtos afetados

Apache Ranger Hive Plugin

Referências · 10

• https://github.com/apache/ranger · Nota
• https://github.com/apache/ranger/commit/9115a20d524ba9173ce5db3e270c385d58d8aeab · Nota
• https://github.com/apache/ranger/commit/7dec3015ec82b69ba8f724410f12dfce2480cccd · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2021-40331 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2021-40331 · Aviso do Fabricante
• https://t.me/cibsecurity/63354 · Publicação no Telegram
• https://lists.apache.org/thread/s68yls6cnkdmzn1k4hqt50vs6wjvt2rn · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-vjr2-wpfh-5r9p · Aviso do Fabricante
• https://issues.apache.org/jira/browse/RANGER-3474 · Nota
• https://issues.apache.org/jira/browse/RANGER-3357 · Nota