CVE-2018-1315

In Apache Hive 2.1.0 to 2.3.2, when 'COPY FROM FTP' statement is run using HPL/SQL extension to Hive, a compromised/malicious FTP server can cause the file to be written to an arbitrary location on the cluster where the command is run from. This is because FTP client code in HPL/SQL does not veri...

CVE-2018-1282

CVE-2018-1282 affects Apache Hive JDBC driver versions 0.7.1 through 2.3.2. The vulnerability arises from an error in the PreparedStatement argument handling, allowing carefully crafted inputs to bypass the driver’s argument escaping/cleanup. Several connected documents corroborate this CVE in th...

CVE-2018-1282

This vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 allows carefully crafted arguments to be used to bypass the argument escaping/cleanup that JDBC driver does in PreparedStatement implementation...

CVE-2018-1284

CVE-2018-1284 affects Apache Hive versions 0.6.0 through 2.3.2. A malicious user can leverage any of the xpath UDFs (xpath, xpath_string, xpath_boolean, xpath_number, xpath_double, xpath_float, xpath_long, xpath_int, xpath_short) to expose the content of a local file on the machine running HiveSe...

CVE-2018-1315

CVE-2018-1315 affects Apache Hive 2.1.0–2.3.2 when using the HPL/SQL extension and issuing COPY FROM FTP. The FTP client does not verify the destination path, allowing a compromised FTP server to cause the downloaded file to be written to an arbitrary location on the cluster where the command is ...

CVE-2018-1284

In Apache Hive 0.6.0 to 2.3.2, malicious user might use any xpath UDFs xpath/xpathstring/xpathboolean/xpathnumber/xpathdouble/xpathfloat/xpathlong/xpathint/xpathshort to expose the content of a file on the machine running HiveServer2 owned by HiveServer2 user usually hive if...

Unauthorised Arbitrary File Access Through XML External Entity (XXE)

Apache Hive Query Language is vulnerable to unauthorized arbitrary file access through XML external entity XXE . Using xpath UDFs, an attacker can reveal any file on a machine running HiveServer 2 only if the hive.server2.enable.doAs variable is set to false...

Unauthorized Write To Arbitrary Location

Hive HPL/SQL is vulnerable to unauthorized write to arbitrary location. FTP client in HPL/SQL fails to validate the download destination location for COPY FROM FTP statement, thereby allowing a malicious FTP server to run the command to download the file to any location...

CVE-2018-1315: Incorrect Permission Assignment for Critical Resource

In Apache Hive 2.1.0 to 2.3.2, when 'COPY FROM FTP' statement is run using HPL/SQL extension to Hive, a compromised/malicious FTP server can cause the file to be written to an arbitrary location on the cluster where the command is run from. This is because FTP client code in HPL/SQL does not veri...

PT-2018-11430

Name of the Vulnerable Software and Affected Versions Apache Hive versions 0.6.0 through 2.3.2 Description A malicious user might exploit xpath UDFs such as xpath, xpath string, xpath boolean, xpath number, xpath double, xpath float, xpath long, xpath int, xpath short to expose the content of a...

PT-2018-3928 · Apache +1 · Apache Hive Jdbc Driver +1

Name of the Vulnerable Software and Affected Versions: Apache Hive JDBC driver versions 0.7.1 through 2.3.2 Oracle Business Intelligence Enterprise Edition Analytics Server affected versions not specified Description: The issue allows an attacker to bypass argument escaping in the JDBC driver's...

CVE-2018-1284: Exposure of Sensitive Information to an Unauthorized Actor

In Apache Hive 0.6.0 to 2.3.2, malicious user might use any xpath UDFs xpath/xpathstring/xpathboolean/xpathnumber/xpathdouble/xpathfloat/xpathlong/xpathint/xpathshort to expose the content of a file on the machine running HiveServer2 owned by HiveServer2 user usually hive if...

CVE-2018-1282: Improper Neutralization of Special Elements used in an SQL Command

This vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 allows carefully crafted arguments to be used to bypass the argument escaping/cleanup that JDBC driver does in PreparedStatement implementation...

PT-2018-11631

Name of the Vulnerable Software and Affected Versions Apache Hive versions 2.1.0 through 2.3.2 Description The issue arises when the 'COPY FROM FTP' statement is executed using the HPL/SQL extension to Hive. A malicious FTP server can cause a file to be written to an arbitrary location on the...

Arbitrary File Write

Amendment This was deemed not a vulnerability. Overview org.apache.hive:hive-common is a reading, writing, and managing large datasets residing in distributed storage using SQL. Affected versions of this package are vulnerable to Arbitrary File Write via the File Transfer Protocol FTP client...

Arbitrary File Write

Overview org.apache.hive:hive-hplsql is a data warehouse software facilitates reading, writing, and managing large datasets residing in distributed storage using SQL. Affected versions of this package are vulnerable to Arbitrary File Write via the File Transfer Protocol FTP client functionality...

Apache Ranger Security Bypass Vulnerability

Apache Ranger is the Apache Software Foundation's architecture for implementing comprehensive security measures for Hadoop clusters, which provides centralized security policy management for core enterprise security requirements such as authorization, billing, and data protection.Hive Authorizer ...

Vault 8: WikiLeaks Releases Source Code For Hive - CIA's Malware Control System

Almost two months after releasing details of 23 different secret CIA hacking tool projects under Vault 7 series, Wikileaks today announced a new Vault 8 series that will reveal source codes and information about the backend infrastructure developed by the CIA hackers. Not just announcement, but t...

Apache Hive Information Disclosure Vulnerability

Apache Hive is a set of Hadoop Distributed Systems Infrastructure based data warehouse software from the Apache Apache Software Foundation in the United States. The software provides a data integration approach and a high-level query language to support large-scale data analysis on Hadoop. An...

Code injection

Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be defined on tables or views, e.g., using Apache Ranger. When a view is created over a given table, the policy enforcement does not happen correctly on the table for...