io.hetu.core:hetu-carbondata (>=1.0.1, <=1.9.0), org.apache.atlas:hive-bridge (>=2.0.0, <=2.2.0) +29 more potentially affected by CVE-2018-11777 via org.apache.hive:hive-exec (>=3.0.0, <=3.1.0)

org.apache.hive:hive-exec MAVEN version =3.0.0, =1.0.1, =2.0.0, =2.0.0, =2.0.0, =apache-carbondata-2.3.1-rc1, =apache-carbondata-2.3.1-rc1, =apache-carbondata-2.3.1-rc1, =apache-carbondata-2.3.1-rc1, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.1.0 and more Source cves: CVE-2018-117...

com.thinkbiganalytics.kylo:kylo-kerberos-test-client (0.9.1), org.apache.hive.hcatalog:hive-hcatalog-core (0.14.0) +13 more potentially affected by CVE-2018-11777 via org.apache.hive:hive-exec (0.14.0)

org.apache.hive:hive-exec MAVEN version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - com.thinkbiganalytics.kylo:kylo-kerberos-test-client 0.9.1 - org.apache.hive.hcatalog:hive-hcatalog-core...

com.alibaba.blink:flink-hcatalog (>=blink-3.2.0, <=1.5.1), com.esri.hadoop:spatial-sdk-hive (1.1) +26 more potentially affected by CVE-2018-11777 via org.apache.hive:hive-exec (0.12.0)

org.apache.hive:hive-exec MAVEN version 0.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - com.alibaba.blink:flink-hcatalog =blink-3.2.0, =1.11.2, =1.11.2, =0.2.7, =1.2.9, =1.2.9, =0.9.0-milestone-1,...

org.apache.nifi:nifi-hive_1_1-nar (>=1.14.0, <=1.28.1), org.apache.nifi:nifi-hive_1_1-processors (>=1.14.0, <=1.28.1) potentially affected by CVE-2018-11777 via org.apache.hive:hive-exec (1.1.1)

org.apache.hive:hive-exec MAVEN version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - org.apache.nifi:nifi-hive11-nar =1.14.0, =1.14.0, =1.28.1 Source cves: CVE-2018-11777 Source advisory:...

io.hetu.core:hetu-carbondata (>=1.0.1, <=1.9.0), org.apache.atlas:hive-bridge (>=2.0.0, <=2.2.0) +29 more potentially affected by CVE-2018-11777 via org.apache.hive:hive-exec (>=3.0.0, <=3.1.0)

org.apache.hive:hive-exec MAVEN version =3.0.0, =1.0.1, =2.0.0, =2.0.0, =2.0.0, =apache-carbondata-2.3.1-rc1, =apache-carbondata-2.3.1-rc1, =apache-carbondata-2.3.1-rc1, =apache-carbondata-2.3.1-rc1, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.1.0 and more Source cves: CVE-2018-117...

com.github.sakserv:hadoop-mini-clusters (0.0.14), org.apache.atlas:falcon-bridge (>=0.7-incubating, <=2.5.0) +38 more potentially affected by CVE-2018-11777 via org.apache.hive:hive-exec (0.13.1)

org.apache.hive:hive-exec MAVEN version 0.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - com.github.sakserv:hadoop-mini-clusters 0.0.14 - org.apache.atlas:falcon-bridge =0.7-incubating,...

com.u51.marble:marble-benchmark (1.0.0), com.u51.marble:marble-table-hive (1.0.0) +19 more potentially affected by CVE-2018-11777 via org.apache.hive:hive-exec (1.2.1)

org.apache.hive:hive-exec MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - com.u51.marble:marble-benchmark 1.0.0 - com.u51.marble:marble-table-hive 1.0.0 -...

com.amazon.emr:hive2-shims (>=5.0.0, <=5.6.0), com.dtstack:dt-insight-hive-shade (>=4.1.2-release, <=4.1.3) +25 more potentially affected by CVE-2018-11777 via org.apache.hive:hive-exec (>=2.0.0, <=2.3.3)

org.apache.hive:hive-exec MAVEN version =2.0.0, =5.0.0, =4.1.2-release, =5.6.0, =0.10.0, =1.13.0, =4.0.0-alpha-2, =0.12.0, =0.9.0, =0.14.0, =0.14.0, =1.0.0-beta1 and more Source cves: CVE-2018-11777 Source advisory: OSV:GHSA-RRFQ-G5FQ-FC9C...

com.amazon.emr:hive2-shims (>=5.0.0, <=5.6.0), com.dtstack:dt-insight-hive-shade (>=4.1.2-release, <=4.1.3) +25 more potentially affected by CVE-2018-11777 via org.apache.hive:hive-exec (>=2.0.0, <=2.3.3)

org.apache.hive:hive-exec MAVEN version =2.0.0, =5.0.0, =4.1.2-release, =5.6.0, =0.10.0, =1.13.0, =4.0.0-alpha-2, =0.12.0, =0.9.0, =0.14.0, =0.14.0, =1.0.0-beta1 and more Source cves: CVE-2018-11777 Source advisory: GHSA-RRFQ-G5FQ-FC9C...

com.bazaarvoice.emodb:emodb-sor-hive (>=1.0.1-migration, <=6.2.3), com.twitter.ambrose:ambrose-hive (>=0.4.0, <=0.4.3) +32 more potentially affected by CVE-2018-11777 via org.apache.hive:hive-exec (0.13.0)

org.apache.hive:hive-exec MAVEN version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - com.bazaarvoice.emodb:emodb-sor-hive =1.0.1-migration, =0.4.0, =0.0.0, =1.7, =2.4 -...

ai.h2o:h2o-orc-parser (>=3.18.0.9, <=3.46.0.12), com.alibaba.blink:flink-hcatalog (>=blink-3.2.0, <=1.5.1) +168 more potentially affected by CVE-2018-11777 via org.apache.hive:hive-exec (>=0.8.0, <=2.3.3)

org.apache.hive:hive-exec MAVEN version =0.8.0, =3.18.0.9, =blink-3.2.0, =5.0.0, =1.0.1-migration, =0.60.0, =4.1.2-release, =1.0.1, =0.6, =0.6, =0.6, =0.6, =0.7 - com.facebook.giraph.hive:hive-io-experimental 0.5 - com.facebook.hiveio:hive-io-exp-cmdline 0.8 - com.facebook.hiveio:hive-io-exp-core...

io.hetu.core:hetu-carbondata (>=1.0.1, <=1.9.0), org.apache.atlas:hive-bridge (>=2.0.0, <=2.2.0) +29 more potentially affected by CVE-2018-11777 via org.apache.hive:hive-exec (>=3.0.0, <=3.1.0)

org.apache.hive:hive-exec MAVEN version =3.0.0, =1.0.1, =2.0.0, =2.0.0, =2.0.0, =apache-carbondata-2.3.1-rc1, =apache-carbondata-2.3.1-rc1, =apache-carbondata-2.3.1-rc1, =apache-carbondata-2.3.1-rc1, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.1.0 and more Source cves: CVE-2018-117...

CVE-2018-11777

CVE-2018-11777 affects Apache Hive (HiveServer2). In HiveServer2, local resources are not properly protected against a malicious user when the Ranger, Sentry, or SQL standard authorizer is not in use, across Hive versions 2.3.3, 3.1.0 and earlier. The root cause is insufficient protection of loca...