PT-2017-8326 · Apache · Apache Hive

Branden Crawford · Published 2017-05-30 · Updated 2019-03-14 · CVE-2016-3083

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Hive versions prior to 1.2.2 Apache Hive versions 2.0.x prior to 2.0.1

Description The issue arises during the validation of the server's certificate in the connection setup. The client fails to verify the common name attribute of the certificate. This allows a scenario where a JDBC client sending an SSL request to a server, for example, abc.com, will accept a valid certificate issued to a different domain, such as xyz.com, as long as it is certified by a CA. This compromises the security of the SSL handshake.

Recommendations For Apache Hive versions prior to 1.2.2, update to version 1.2.2 or later to resolve the issue. For Apache Hive versions 2.0.x prior to 2.0.1, update to version 2.0.1 or later to resolve the issue.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2016-3083

GHSA-GF2V-9HP6-44QG

Affected Products

Apache Hive

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2016-3083 · Security Note
• https://osv.dev/vulnerability/CVE-2016-3083 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gf2v-9hp6-44qg · Vendor Advisory
• https://lists.apache.org/thread.html/0851bcf85635385f94cdaa008053802d92b4aab0a3075e30ed171192%40%3Cdev.hive.apache.org%3E · Note
• https://github.com/advisories/GHSA-gf2v-9hp6-44qg · Note
• http://securityfocus.com/bid/98669 · Note
• https://lists.apache.org/thread.html/0851bcf85635385f94cdaa008053802d92b4aab0a3075e30ed171192@%3Cdev.hive.apache.org%3E · Note