Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection through the direct-SQL partition-name resolution paths in DirectSqlUpdatePart.getPartitionInfo and MetaStoreDirectSql.getPartitionsByNames. An attacker can cause metastore RPCs to target unintended partitions by...