Security Bulletin: Common Vulnerabilities in Cloudera Data Platform Private Cloud Base 7.1.9.

Summary Common vulnerabilities reported in Cloudera Data Platform Private Cloud Base 7.1.9 have been addressed, and are available in Hotfix 2. Vulnerability Details CVEID:CVE-2015-1772 DESCRIPTION: Apache Hive could allow a remote attacker to bypass security restrictions, caused by an error in th...

org.apache.hive:hive-cli (0.8.0), org.apache.hive:hive-hwi (0.8.0) +1 more potentially affected by CVE-2016-3083 via org.apache.hive:hive-service (0.8.0)

org.apache.hive:hive-service MAVEN version 0.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-service and may be impacted: - org.apache.hive:hive-cli 0.8.0 - org.apache.hive:hive-hwi 0.8.0 - org.apache.hive:hive-jdbc 0.8.0 Sourc...

org.apache.hive:hive-cli (0.8.1), org.apache.hive:hive-hwi (0.8.1) +1 more potentially affected by CVE-2016-3083 via org.apache.hive:hive-service (0.8.1)

org.apache.hive:hive-service MAVEN version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-service and may be impacted: - org.apache.hive:hive-cli 0.8.1 - org.apache.hive:hive-hwi 0.8.1 - org.apache.hive:hive-jdbc 0.8.1 Sourc...

com.datasalt.pangool:pangool-examples (>=0.60.0, <=0.70), com.esri.hadoop:spatial-sdk-hive (>=1.0.1, <=1.0.2) +15 more potentially affected by CVE-2016-3083 via org.apache.hive:hive-service (0.10.0)

org.apache.hive:hive-service MAVEN version 0.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-service and may be impacted: - com.datasalt.pangool:pangool-examples =0.60.0, =1.0.1, =0.2.2, =0.2.2, =1.2.0, =1.1.0, =1.2.0-hadoop2 ...

com.nflabs.zeppelin:zeppelin-cli (0.2.0), com.nflabs.zeppelin:zeppelin-distribution (>=0.2.0, <=0.3.3) +13 more potentially affected by CVE-2016-3083 via org.apache.hive:hive-service (0.11.0)

org.apache.hive:hive-service MAVEN version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-service and may be impacted: - com.nflabs.zeppelin:zeppelin-cli 0.2.0 - com.nflabs.zeppelin:zeppelin-distribution =0.2.0, =0.3.0,...

com.alibaba.blink:flink-hcatalog (>=blink-3.2.0, <=1.5.1), com.qcloud.oceanus:flink-hcatalog_2.11 (1.10.1) +14 more potentially affected by CVE-2016-3083 via org.apache.hive:hive-service (0.12.0)

org.apache.hive:hive-service MAVEN version 0.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-service and may be impacted: - com.alibaba.blink:flink-hcatalog =blink-3.2.0, =0.2.7, =0.9.0-milestone-1, =0.10.0, =1.7.0, =1.16.3 -...

com.twitter.ambrose:ambrose-hive (>=0.4.0, <=0.4.3), io.teknek:hiveunit (>=0.0.0, <=0.0.2) +16 more potentially affected by CVE-2016-3083 via org.apache.hive:hive-service (0.13.0)

org.apache.hive:hive-service MAVEN version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-service and may be impacted: - com.twitter.ambrose:ambrose-hive =0.4.0, =0.0.0, =0.0.2 - org.apache.hive.hcatalog:hive-hcatalog-core...

com.thinkbiganalytics.kylo:kylo-kerberos-test-client (>=0.8.3, <=0.9.1), org.apache.hive.hcatalog:hive-hcatalog-core (0.14.0) +12 more potentially affected by CVE-2016-3083 via org.apache.hive:hive-service (0.14.0)

org.apache.hive:hive-service MAVEN version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-service and may be impacted: - com.thinkbiganalytics.kylo:kylo-kerberos-test-client =0.8.3, =0.9.1 -...

com.ge.research.semtk:arangodbservice (2.2.2), com.ge.research.semtk:athenaservice (2.2.2) +68 more potentially affected by CVE-2016-3083 via org.apache.hive:hive-service (>=1.0.0, <=1.2.1)

org.apache.hive:hive-service MAVEN version =1.0.0, =2.2.1, =2.2.1, =2.2.1, =2.2.2 - com.ge.research.semtk:sparqlgraphresultsservice 2.2.2 and more Source cves: CVE-2016-3083 Source advisory: GHSA-GF2V-9HP6-44QG...

com.nflabs.zeppelin:zeppelin-cli (>=0.1.0, <=0.1.2), com.nflabs.zeppelin:zeppelin-server (>=0.1.0, <=0.1.2) +8 more potentially affected by CVE-2016-3083 via org.apache.hive:hive-exec (0.9.0)

org.apache.hive:hive-exec MAVEN version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - com.nflabs.zeppelin:zeppelin-cli =0.1.0, =0.1.0, =0.1.0, =0.1.2 -...

com.datasalt.pangool:pangool-examples (>=0.60.0, <=0.70), com.esri.hadoop:spatial-sdk-hive (>=1.0.1, <=1.0.2) +34 more potentially affected by CVE-2016-3083 via org.apache.hive:hive-exec (0.10.0)

org.apache.hive:hive-exec MAVEN version 0.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - com.datasalt.pangool:pangool-examples =0.60.0, =1.0.1, =0.6, =0.6, =0.6, =0.6, =1.11.2, =0.5.5, =0.2.2, =0.2...

com.nflabs.zeppelin:zeppelin-cli (0.2.0), com.nflabs.zeppelin:zeppelin-distribution (>=0.2.0, <=0.3.3) +18 more potentially affected by CVE-2016-3083 via org.apache.hive:hive-exec (0.11.0)

org.apache.hive:hive-exec MAVEN version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - com.nflabs.zeppelin:zeppelin-cli 0.2.0 - com.nflabs.zeppelin:zeppelin-distribution =0.2.0, =0.3.0, =1.2.0,...

com.alibaba.blink:flink-hcatalog (>=blink-3.2.0, <=1.5.1), com.esri.hadoop:spatial-sdk-hive (1.1) +26 more potentially affected by CVE-2016-3083 via org.apache.hive:hive-exec (0.12.0)

org.apache.hive:hive-exec MAVEN version 0.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - com.alibaba.blink:flink-hcatalog =blink-3.2.0, =1.11.2, =1.11.2, =0.2.7, =1.2.9, =1.2.9, =0.9.0-milestone-1,...

com.bazaarvoice.emodb:emodb-sor-hive (>=1.0.1-migration, <=6.2.3), com.twitter.ambrose:ambrose-hive (>=0.4.0, <=0.4.3) +32 more potentially affected by CVE-2016-3083 via org.apache.hive:hive-exec (0.13.0)

org.apache.hive:hive-exec MAVEN version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - com.bazaarvoice.emodb:emodb-sor-hive =1.0.1-migration, =0.4.0, =0.0.0, =1.7, =2.4 -...

com.thinkbiganalytics.kylo:kylo-kerberos-test-client (0.9.1), org.apache.hive.hcatalog:hive-hcatalog-core (0.14.0) +13 more potentially affected by CVE-2016-3083 via org.apache.hive:hive-exec (0.14.0)

org.apache.hive:hive-exec MAVEN version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - com.thinkbiganalytics.kylo:kylo-kerberos-test-client 0.9.1 - org.apache.hive.hcatalog:hive-hcatalog-core...

ai.h2o:h2o-orc-parser (>=3.18.0.9, <=3.46.0.12), com.linkedin.tony:tony-cli (>=0.1.5, <=0.3.3) +26 more potentially affected by CVE-2016-3083 via org.apache.hive:hive-exec (>=1.1.0, <=1.2.1)

org.apache.hive:hive-exec MAVEN version =1.1.0, =3.18.0.9, =0.1.5, =0.1.5, =6.5.0, =6.5.0, =6.5.0, =6.5.0, =0.14.0, =0.14.0, =0.15.0, =0.15.0, =0.15.1 and more Source cves: CVE-2016-3083 Source advisory: OSV:GHSA-GF2V-9HP6-44QG...

ai.h2o:h2o-orc-parser (>=3.18.0.9, <=3.46.0.12), com.linkedin.tony:tony-cli (>=0.1.5, <=0.3.3) +26 more potentially affected by CVE-2016-3083 via org.apache.hive:hive-exec (>=1.1.0, <=1.2.1)

org.apache.hive:hive-exec MAVEN version =1.1.0, =3.18.0.9, =0.1.5, =0.1.5, =6.5.0, =6.5.0, =6.5.0, =6.5.0, =0.14.0, =0.14.0, =0.15.0, =0.15.0, =0.15.1 and more Source cves: CVE-2016-3083 Source advisory: GHSA-GF2V-9HP6-44QG...

io.druid.extensions.contrib:druid-orc-extensions (>=0.10.0, <=0.12.3), org.apache.tajo:tajo-hive (>=0.11.2, <=0.11.3) potentially affected by CVE-2016-3083 via org.apache.hive:hive-exec (2.0.0)

org.apache.hive:hive-exec MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - io.druid.extensions.contrib:druid-orc-extensions =0.10.0, =0.11.2, =0.11.3 Source cves: CVE-2016-3083 Source...

io.druid.extensions.contrib:druid-orc-extensions (>=0.10.0, <=0.12.3), org.apache.tajo:tajo-hive (>=0.11.2, <=0.11.3) potentially affected by CVE-2016-3083 via org.apache.hive:hive-exec (2.0.0)

org.apache.hive:hive-exec MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - io.druid.extensions.contrib:druid-orc-extensions =0.10.0, =0.11.2, =0.11.3 Source cves: CVE-2016-3083 Source...

org.apache.hive:hive-cli (0.8.0), org.apache.hive:hive-contrib (0.8.0) +4 more potentially affected by CVE-2016-3083 via org.apache.hive:hive-exec (0.8.0)

org.apache.hive:hive-exec MAVEN version 0.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - org.apache.hive:hive-cli 0.8.0 - org.apache.hive:hive-contrib 0.8.0 - org.apache.hive:hive-hbase-handler 0.8....