Moderate severity vulnerability that affects org.apache.hive:hive-jdbc

2018-11-2122:24:50

Google

osv.dev

0.001 Low

EPSS

Percentile

29.1%

JSON

In Apache Hive 2.3.3, 3.1.0 and earlier, Hive “EXPLAIN” operation does not check for necessary authorization of involved entities in a query. An unauthorized user can do “EXPLAIN” on arbitrary table or view and expose table metadata and statistics.

CPENameOperatorVersion
org.apache.hive:hive-jdbceq2.0.1
org.apache.hive:hive-jdbceq1.2.1
org.apache.hive:hive-jdbceq0.12.0
org.apache.hive:hive-jdbceq1.2.2
org.apache.hive:hive-jdbceq2.2.0
org.apache.hive:hive-jdbceq0.13.0
org.apache.hive:hive-jdbceq2.1.0
org.apache.hive:hive-jdbceq2.3.0
org.apache.hive:hive-jdbceq2.3.1
org.apache.hive:hive-jdbceq0.14.0

Name	Operator	Version
org.apache.hive:hive-jdbc	eq	2.0.1
org.apache.hive:hive-jdbc	eq	1.2.1
org.apache.hive:hive-jdbc	eq	0.12.0
org.apache.hive:hive-jdbc	eq	1.2.2
org.apache.hive:hive-jdbc	eq	2.2.0
org.apache.hive:hive-jdbc	eq	0.13.0
org.apache.hive:hive-jdbc	eq	2.1.0
org.apache.hive:hive-jdbc	eq	2.3.0
org.apache.hive:hive-jdbc	eq	2.3.1
org.apache.hive:hive-jdbc	eq	0.14.0