PT-2022-10351 · Apache · Apache Hive

Hideyuki Furue · Published 2022-07-16 · Updated 2022-07-21 · CVE-2021-34538

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Hive versions prior to 3.1.3

Description The issue arises from the lack of necessary authorization checks for involved entities in the query during CREATE and DROP function operations. This allows an unauthorized user to manipulate an existing UDF without proper privileges, enabling them to drop and recreate UDFs that point to potentially malicious jars.

Recommendations For versions prior to 3.1.3, update to version 3.1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the CREATE and DROP function operations to authorized users only, and monitor UDF manipulations closely to minimize the risk of exploitation.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2021-34538

GHSA-V3P8-J597-3XG8

Affected Products

Apache Hive

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-34538 · Security Note
• https://osv.dev/vulnerability/CVE-2021-34538 · Vendor Advisory
• https://lists.apache.org/thread/oqqgnhz4c6nxsfd0xstosnk0g15f7354 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v3p8-j597-3xg8 · Vendor Advisory
• https://github.com/apache/hive · Note
• https://t.me/cvenotify/33194 · Telegram Post