Server-side Request Forgery (SSRF)

Overview org.apache.hive:hive-exec is a package for reading, writing, and managing large datasets residing in distributed storage using SQL. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via Avro SerDe schema resolution in...

Improper Access Control

org.apache.hive:hive-exec is vulnerable to Improper Access Control. The vulnerability is due to insecure file permissions due to the credentials file being created with default permissions of 644 in a temporary directory, allowing unauthorized users to read sensitive information...

org.apache.spark:spark-hive-thriftserver_2.12 (3.0.0-preview2), org.apache.spark:spark-hive_2.12 (3.0.0-preview2) +4 more potentially affected by CVE-2024-29869 via org.apache.hive:hive-exec (2.3.6)

org.apache.hive:hive-exec MAVEN version 2.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - org.apache.spark:spark-hive-thriftserver2.12 3.0.0-preview2 - org.apache.spark:spark-hive2.12 3.0.0-preview2 ...

com.webank.wedatasphere.linkis:linkis-engineplugin-hive (1.0.2), org.apache.hive:hive-pre-upgrade (>=4.0.0-alpha-2, <=4.0.0-beta-1) +3 more potentially affected by CVE-2024-29869 via org.apache.hive:hive-exec (2.3.3)

org.apache.hive:hive-exec MAVEN version 2.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - com.webank.wedatasphere.linkis:linkis-engineplugin-hive 1.0.2 - org.apache.hive:hive-pre-upgrade...

org.apache.drill.contrib.storage-hive:drill-hive-exec-shaded (>=1.13.0, <=1.17.0), org.apache.drill.contrib.storage-hive:drill-storage-hive-core (1.16.0) potentially affected by CVE-2024-29869 via org.apache.hive:hive-exec (2.3.2)

org.apache.hive:hive-exec MAVEN version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - org.apache.drill.contrib.storage-hive:drill-hive-exec-shaded =1.13.0, =1.17.0 -...

org.apache.hudi:hudi-adb-sync (>=0.12.0, <=1.0.0-beta1), org.apache.hudi:hudi-dla-sync (>=0.9.0, <=0.11.1) +8 more potentially affected by CVE-2024-29869 via org.apache.hive:hive-exec (2.3.1)

org.apache.hive:hive-exec MAVEN version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - org.apache.hudi:hudi-adb-sync =0.12.0, =0.9.0, =0.14.0, =0.14.0, =0.9.0, =0.14.0, =0.14.0, =0.11.0-rc3,...

com.amazon.emr:hive2-shims (>=5.0.0, <=5.6.0), com.scylladb.alternator:hive2-shims (>=5.6.0, <=5.9.2) potentially affected by CVE-2024-29869 via org.apache.hive:hive-exec (2.3.0)

org.apache.hive:hive-exec MAVEN version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - com.amazon.emr:hive2-shims =5.0.0, =5.6.0, =5.9.2 Source cves: CVE-2024-29869 Source advisory:...

com.dtstack:dt-insight-hive-shade (>=4.1.2-release, <=4.1.3), io.eels:eel-hive_2.11 (1.0.2) +4 more potentially affected by CVE-2024-29869 via org.apache.hive:hive-exec (2.1.0)

org.apache.hive:hive-exec MAVEN version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - com.dtstack:dt-insight-hive-shade =4.1.2-release, =2.6.1, =2.6.1, =2.7.1 Source cves: CVE-2024-29869 Source...

io.druid.extensions.contrib:druid-orc-extensions (>=0.10.0, <=0.12.3), org.apache.tajo:tajo-hive (>=0.11.2, <=0.11.3) potentially affected by CVE-2024-29869 via org.apache.hive:hive-exec (2.0.0)

org.apache.hive:hive-exec MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - io.druid.extensions.contrib:druid-orc-extensions =0.10.0, =0.11.2, =0.11.3 Source cves: CVE-2024-29869 Source...

org.apache.nifi:nifi-hive_1_1-nar (>=1.14.0, <=1.28.1), org.apache.nifi:nifi-hive_1_1-processors (>=1.14.0, <=1.28.1) potentially affected by CVE-2024-29869 via org.apache.hive:hive-exec (1.1.1)

org.apache.hive:hive-exec MAVEN version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - org.apache.nifi:nifi-hive11-nar =1.14.0, =1.14.0, =1.28.1 Source cves: CVE-2024-29869 Source advisory:...

org.apache.hive.hcatalog:hive-hcatalog-core (3.0.0), org.apache.hive.hcatalog:hive-hcatalog-pig-adapter (3.0.0) +18 more potentially affected by CVE-2024-29869 via org.apache.hive:hive-exec (3.0.0)

org.apache.hive:hive-exec MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - org.apache.hive.hcatalog:hive-hcatalog-core 3.0.0 - org.apache.hive.hcatalog:hive-hcatalog-pig-adapter 3.0.0 ...

com.thinkbiganalytics.kylo:kylo-kerberos-test-client (0.9.1), org.apache.hive.hcatalog:hive-hcatalog-core (0.14.0) +13 more potentially affected by CVE-2024-29869 via org.apache.hive:hive-exec (0.14.0)

org.apache.hive:hive-exec MAVEN version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - com.thinkbiganalytics.kylo:kylo-kerberos-test-client 0.9.1 - org.apache.hive.hcatalog:hive-hcatalog-core...

com.github.sakserv:hadoop-mini-clusters (0.0.14), org.apache.atlas:falcon-bridge (>=0.7-incubating, <=2.5.0) +38 more potentially affected by CVE-2024-29869 via org.apache.hive:hive-exec (0.13.1)

org.apache.hive:hive-exec MAVEN version 0.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - com.github.sakserv:hadoop-mini-clusters 0.0.14 - org.apache.atlas:falcon-bridge =0.7-incubating,...

com.nflabs.zeppelin:zeppelin-cli (0.2.0), com.nflabs.zeppelin:zeppelin-distribution (>=0.2.0, <=0.3.3) +18 more potentially affected by CVE-2024-29869 via org.apache.hive:hive-exec (0.11.0)

org.apache.hive:hive-exec MAVEN version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - com.nflabs.zeppelin:zeppelin-cli 0.2.0 - com.nflabs.zeppelin:zeppelin-distribution =0.2.0, =0.3.0, =1.2.0,...

org.apache.hive:hive-cli (0.8.1), org.apache.hive:hive-contrib (0.8.1) +4 more potentially affected by CVE-2024-29869 via org.apache.hive:hive-exec (0.8.1)

org.apache.hive:hive-exec MAVEN version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - org.apache.hive:hive-cli 0.8.1 - org.apache.hive:hive-contrib 0.8.1 - org.apache.hive:hive-hbase-handler 0.8....

org.apache.hive.hcatalog:hive-hcatalog-core (4.0.0-alpha-1), org.apache.hive.hcatalog:hive-hcatalog-pig-adapter (4.0.0-alpha-1) +18 more potentially affected by CVE-2022-41137 via org.apache.hive:hive-exec (4.0.0-alpha-1)

org.apache.hive:hive-exec MAVEN version 4.0.0-alpha-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - org.apache.hive.hcatalog:hive-hcatalog-core 4.0.0-alpha-1 -...

org.apache.hive.hcatalog:hive-hcatalog-core (4.0.0-alpha-1), org.apache.hive.hcatalog:hive-hcatalog-pig-adapter (4.0.0-alpha-1) +18 more potentially affected by CVE-2022-41137 via org.apache.hive:hive-exec (4.0.0-alpha-1)

org.apache.hive:hive-exec MAVEN version 4.0.0-alpha-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - org.apache.hive.hcatalog:hive-hcatalog-core 4.0.0-alpha-1 -...

ai.h2o:h2o-orc-parser (>=3.18.0.9, <=3.46.0.12), com.linkedin.tony:tony-cli (>=0.1.5, <=0.3.3) +3 more potentially affected by CVE-2015-1772 via org.apache.hive:hive-exec (1.1.0)

org.apache.hive:hive-exec MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - ai.h2o:h2o-orc-parser =3.18.0.9, =0.1.5, =0.1.5, =0.11.0, =0.11.1 Source cves: CVE-2015-1772 Source advisory:...

com.nflabs.zeppelin:zeppelin-cli (>=0.1.0, <=0.1.2), com.nflabs.zeppelin:zeppelin-server (>=0.1.0, <=0.1.2) +8 more potentially affected by CVE-2016-3083 via org.apache.hive:hive-exec (0.9.0)

org.apache.hive:hive-exec MAVEN version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - com.nflabs.zeppelin:zeppelin-cli =0.1.0, =0.1.0, =0.1.0, =0.1.2 -...

com.nflabs.zeppelin:zeppelin-cli (0.2.0), com.nflabs.zeppelin:zeppelin-distribution (>=0.2.0, <=0.3.3) +18 more potentially affected by CVE-2016-3083 via org.apache.hive:hive-exec (0.11.0)

org.apache.hive:hive-exec MAVEN version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - com.nflabs.zeppelin:zeppelin-cli 0.2.0 - com.nflabs.zeppelin:zeppelin-distribution =0.2.0, =0.3.0, =1.2.0,...