PT-2018-11430 · Apache · Apache Hive

Daniel Dai · Published 2018-04-05 · Updated 2018-11-21 · CVE-2018-1284

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Hive versions 0.6.0 through 2.3.2

Description A malicious user might exploit xpath UDFs (such as xpath, xpath string, xpath boolean, xpath number, xpath double, xpath float, xpath long, xpath int, xpath short) to expose the content of a file on the machine running HiveServer2. This is possible when the file is owned by the HiveServer2 user (usually hive) and hive.server2.enable.doAs is set to false.

Recommendations For Apache Hive versions 0.6.0 through 2.3.2, consider setting hive.server2.enable.doAs to true to mitigate the risk of file exposure. Additionally, restrict access to the xpath UDFs to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-1284

GHSA-RXMR-C9JM-7MM8

Affected Products

Apache Hive

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2018-1284 · Security Note
• https://osv.dev/vulnerability/GHSA-rxmr-c9jm-7mm8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1284 · Vendor Advisory
• https://github.com/apache/hive/commit/f80a38ae1174553022deae4f8774918401d9756d · Note
• https://lists.apache.org/thread.html/29184dbce4a37be2af36e539ecb479b1d27868f73ccfdff46c7174b4%40%3Cdev.hive.apache.org%3E · Note
• https://issues.apache.org/jira/browse/HIVE-18879 · Note
• https://lists.apache.org/thread.html/29184dbce4a37be2af36e539ecb479b1d27868f73ccfdff46c7174b4@%3Cdev.hive.apache.org%3E · Note
• http://securityfocus.com/bid/103750 · Note
• https://github.com/advisories/GHSA-rxmr-c9jm-7mm8 · Note