~ / search / GHSA-83r3-c79w-f6wc

GHSA-83r3-c79w-f6wc

High severity vulnerability that affects org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service

Source: GitHub Advisory Database (reviewed) High CVE-2015-7521

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.hive:hive >= 1.0.0, < 1.2.2 1.2.2
Maven org.apache.hive:hive-exec >= 1.0.0, < 1.2.2 1.2.2
Maven org.apache.hive:hive-service >= 1.0.0, < 1.2.2 1.2.2

Details

As written in the advisory (Markdown source, shown as plain text).

The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1, on clusters protected by Ranger and SqlStdHiveAuthorization, allows attackers to bypass intended parent table access restrictions via unspecified partition-level operations.

References

External links from the advisory. They lead to third-party sites.