CVE-2014-0228

EPSS 0.32%

Low severity vulnerability that affects org.apache.hive:hive-exec, org.apache.hive:hive, and org.apache.hive:hive-service

Published: 11/21/2018Modified: 12/2/2024

Description

Apache Hive before 0.13.1, when in SQL standards based authorization mode, does not properly check the file permissions for (1) import and (2) export statements, which allows remote authenticated users to obtain sensitive information via a crafted URI.

Affected packages (3)

Maven/org.apache.hive:hivefrom 0, < 0.13.1
Maven/org.apache.hive:hive-execfrom 0, < 0.13.1
Maven/org.apache.hive:hive-servicefrom 0, < 0.13.1

References (5)

ADVISORYhttps://github.com/advisories/GHSA-w4x9-4f5x-8jj8
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2014-0228
WEBhttp://mail-archives.apache.org/mod_mbox/hive-user/201406.mbox/%3CCABgNGzeN7E+9d=YV5yvnKA7wmSx1op_avtUjPcPtDaR6DLJM6g@mail.gmail.com%3E
WEBhttp://packetstormsecurity.com/files/127091/Apache-Hive-0.13.0-Authorization-Failure.html
WEBhttp://www.securityfocus.com/archive/1/532418/100/0/threaded