~ / search / GHSA-v3p8-j597-3xg8

GHSA-v3p8-j597-3xg8

Apache Hive before 3.1.3 `CREATE` and `DROP` function operations do not check for necessary authorization.

Source: GitHub Advisory Database (reviewed) High CVE-2021-34538

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.hive:hive < 3.1.3 3.1.3

Details

As written in the advisory (Markdown source, shown as plain text).

Apache Hive before 3.1.3 `CREATE` and `DROP` function operations do not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged users to drop and recreate UDFs pointing them to new jars that could be potentially malicious.

References

External links from the advisory. They lead to third-party sites.