Lucene search

K
githubGitHub Advisory DatabaseGHSA-2G9Q-CHQ2-W8QW
HistoryMar 14, 2019 - 3:40 p.m.

Moderate severity vulnerability that affects org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service

2019-03-1415:40:16
CWE-200
GitHub Advisory Database
github.com
14

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

0.0004 Low

EPSS

Percentile

16.0%

Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be defined on tables or views, e.g., using Apache Ranger. When a view is created over a given table, the policy enforcement does not happen correctly on the table for masked columns.

Affected configurations

Vulners
Node
org.apache.hive\hiveMatchservice2.3.0
OR
org.apache.hive\hiveMatchservice2.2.0
OR
org.apache.hive\hiveMatchservice
OR
org.apache.hive\hiveMatchexec2.3.0
OR
org.apache.hive\hiveMatchexec2.2.0
OR
org.apache.hive\hiveMatchexec
OR
org.apache.hive\Matchhive2.3.0
OR
org.apache.hive\Matchhive2.2.0
OR
org.apache.hive\Matchhive

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

0.0004 Low

EPSS

Percentile

16.0%

Related for GHSA-2G9Q-CHQ2-W8QW