PT-2023-12360 · Apache · Apache Ranger Hive Plugin

Ramesh Mani · Published 2023-05-05 · Updated 2024-10-11 · CVE-2021-40331

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Ranger Hive Plugin versions 2.0.0 through 2.3.0

Description An Incorrect Permission Assignment for Critical Resource issue was found in the Apache Ranger Hive Plugin. Any user with SELECT privilege on a database can alter the ownership of the table in Hive when Apache Ranger Hive Plugin is enabled.

Recommendations For Apache Ranger Hive Plugin versions 2.0.0 through 2.3.0, upgrade to version 2.4.0 or later to resolve the issue. As a temporary workaround, consider restricting the SELECT privilege on databases to minimize the risk of exploitation.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2021-40331

GHSA-VJR2-WPFH-5R9P

Affected Products

Apache Ranger Hive Plugin

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2021-40331 · Security Note
• https://osv.dev/vulnerability/CVE-2021-40331 · Vendor Advisory
• https://lists.apache.org/thread/s68yls6cnkdmzn1k4hqt50vs6wjvt2rn · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vjr2-wpfh-5r9p · Vendor Advisory
• https://github.com/apache/ranger · Note
• https://github.com/apache/ranger/commit/9115a20d524ba9173ce5db3e270c385d58d8aeab · Note
• https://github.com/apache/ranger/commit/7dec3015ec82b69ba8f724410f12dfce2480cccd · Note
• https://t.me/cibsecurity/63354 · Telegram Post
• https://issues.apache.org/jira/browse/RANGER-3474 · Note
• https://issues.apache.org/jira/browse/RANGER-3357 · Note