CVE-2017-12625

Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be defined on tables or views, e.g., using Apache Ranger. When a view is created over a given table, the policy enforcement does not happen correctly on the table for...

CVE-2017-12625

Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be defined on tables or views, e.g., using Apache Ranger. When a view is created over a given table, the policy enforcement does not happen correctly on the table for...

CVE-2017-12625

Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be defined on tables or views, e.g., using Apache Ranger. When a view is created over a given table, the policy enforcement does not happen correctly on the table for...

CVE-2017-12625

Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be defined on tables or views, e.g., using Apache Ranger. When a view is created over a given table, the policy enforcement does not happen correctly on the table for...

CVE-2017-12625

The CVE-2017-12625 issue affects Apache Hive: versions 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface for defining masking policies on tables/views (e.g., via Apache Ranger). Root cause: when a view is created over a table, policy enforcement is not correctly a...

Information Disclosure

Apache Hive Query Language is vulnerable to information disclosure. The vulnerability is possible because it does not enforce the policy to restrict users from creating views on tables with column masking rules defined...

CVE-2017-12625: Exposure of Sensitive Information to an Unauthorized Actor

Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be defined on tables or views, e.g., using Apache Ranger. When a view is created over a given table, the policy enforcement does not happen correctly on the table for...

PT-2017-12609

Name of the Vulnerable Software and Affected Versions Apache Hive versions 2.1.x through 2.1.2 Apache Hive versions 2.2.x through 2.2.1 Apache Hive versions 2.3.x through 2.3.1 Description The issue arises when a view is created over a table, and policy enforcement for masked columns does not occ...

Arbitrary Code Execution

Apache Phoenix-hive is vulnerable to arbitrary code execution attacks. The attacks can be triggered because it directly uses ObjectInputStream which deserializes the classes without validation and leads to code execution...

Clickjacking Attacks

Hive HCatalog Webhcat is vulnerable to clickjacking attacks. The attacks exist due to the lack of the X-Frame-Options header in the HTTP responses sent by the web server...

The Pirate Bay Caught Running Browser-Based Cryptocurrency Miner

The world's popular torrent download website, The Pirate Bay, has again been in a new controversy—this time over secretly planting an in-browser cryptocurrency miner on its website that utilizes its visitors' CPU processing power in order to mine digital currencies. The Pirate Bay is the most...

Pirate Bay Spotted Hosting Monero Cryptocurrency Miner

A cryptocurrency miner surfaced on the world’s largest torrenting site for a day over the weekend, raising the ire of users unaware the tool was there, let alone leveraging their machine’s computing power. Users noticed the miner Friday night on The Pirate Bay, a site that acts as a treasure trov...

Collision Attack

Apache Hive is vulnerable to collision attacks. The vulnerability is possible because it uses the weak hashing algorithm, SHA-1, in src/java/org/apache/hive/service/CookieSigner.java and src/java/org/apache/hadoop/hive/ql/udf/generic/GenericUDFMaskHash.java allowing the attackers to easily perfor...

CVE-2017-7677

In environments that use external location for hive tables, Hive Authorizer in Apache Ranger before 0.7.1 should be checking RWX permission for create table...

CVE-2017-7677

In environments that use external location for hive tables, Hive Authorizer in Apache Ranger before 0.7.1 should be checking RWX permission for create table...

Xxe

In environments that use external location for hive tables, Hive Authorizer in Apache Ranger before 0.7.1 should be checking RWX permission for create table...

CVE-2017-7677

In environments that use external location for hive tables, Hive Authorizer in Apache Ranger before 0.7.1 should be checking RWX permission for create table...

CVE-2017-7677

In environments that use external location for hive tables, Hive Authorizer in Apache Ranger before 0.7.1 should be checking RWX permission for create table...

CVE-2017-7677

CVE-2017-7677 affects the Hive Authorizer in Apache Ranger prior to 0.7.1. In environments using external locations for Hive tables, it should check RWX permissions for create table, but this check is missing, enabling a potential permission-check bypass when creating tables. The issue is address...

PT-2017-17877

Name of the Vulnerable Software and Affected Versions Apache Ranger versions prior to 0.7.1 Description The issue concerns the Hive Authorizer in Apache Ranger, which fails to properly check RWX permission for creating tables in environments that use an external location for hive tables...