CVE-2018-12023 vulnerabilities

Vulnerabilities for packages: hive...

ai.h2o:h2o-orc-parser (>=3.18.0.9 <=3.46.0.11), com.linkedin.tony:tony-cli (>=0.1.5 <=0.3.3) +3 more potentially affected by CVE-2015-1772 via org.apache.hive:hive-exec (=1.1.0)

org.apache.hive:hive-exec MAVEN version =1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - ai.h2o:h2o-orc-parser =3.18.0.9, =0.1.5, =0.1.5, =0.11.0, =0.11.1 Source cves: CVE-2015-1772 Source advisory...

com.huemulsolutions.bigdata:huemul-bigdatagovernance (>=1.1 <=2.1), com.thinkbiganalytics.kylo:kylo-kerberos-test-client (=0.10.0) +3 more potentially affected by CVE-2015-1772 via org.apache.hive:hive-service (=1.1.0)

org.apache.hive:hive-service MAVEN version =1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-service and may be impacted: - com.huemulsolutions.bigdata:huemul-bigdatagovernance =1.1, =2.1 -...

org.apache.hive:hive-beeline (=1.0.0), org.apache.hive:hive-jdbc (=1.0.0) potentially affected by CVE-2015-1772 via org.apache.hive:hive-service (=1.0.0)

org.apache.hive:hive-service MAVEN version =1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-service and may be impacted: - org.apache.hive:hive-beeline =1.0.0 - org.apache.hive:hive-jdbc =1.0.0 Source cves: CVE-2015-1772 Sour...

Improper Authentication in org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service

The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, mishandles simple unauthenticated and anonymous bind configurations, which allows remote attackers to bypass authenticatio...

com.ge.research.semtk:arangoDbService (=2.2.2), com.ge.research.semtk:athenaService (=2.2.2) +74 more potentially affected by CVE-2016-3083 via org.apache.hive:hive-service (>=0.8.0 <=1.2.1)

org.apache.hive:hive-service MAVEN version =0.8.0, =2.2.1, =2.2.1, =2.2.1, =2.2.2 - com.ge.research.semtk:sparqlGraphResultsService =2.2.2 and more Source cves: CVE-2016-3083 Source advisory: OSV:GHSA-GF2V-9HP6-44QG...

io.druid.extensions.contrib:druid-orc-extensions (>=0.10.0 <=0.12.3), org.apache.tajo:tajo-hive (>=0.11.2 <=0.11.3) potentially affected by CVE-2016-3083 via org.apache.hive:hive-exec (=2.0.0)

org.apache.hive:hive-exec MAVEN version =2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - io.druid.extensions.contrib:druid-orc-extensions =0.10.0, =0.11.2, =0.11.3 Source cves: CVE-2016-3083 Source...

ai.h2o:h2o-orc-parser (>=3.18.0.9 <=3.46.0.11), com.linkedin.tony:tony-cli (>=0.1.5 <=0.3.3) +36 more potentially affected by CVE-2016-3083 via org.apache.hive:hive-exec (>=0.8.0 <=1.2.1)

org.apache.hive:hive-exec MAVEN version =0.8.0, =3.18.0.9, =0.1.5, =0.1.5, =0.1.0, =0.1.0, =0.1.0, =6.5.0, =6.5.0, =6.5.0, =6.5.0, =6.8.3 and more Source cves: CVE-2016-3083 Source advisory: OSV:GHSA-GF2V-9HP6-44QG...

GHSA-GF2V-9HP6-44QG org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service vulnerable to Improper Certificate Validation

Apache Hive JDBC + HiveServer2 implements SSL for plain TCP and HTTP connections it supports both transport modes. While validating the server's certificate during the connection setup, the client in Apache Hive before 1.2.2 and 2.0.x before 2.0.1 doesn't seem to be verifying the common name...

org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service vulnerable to Improper Certificate Validation

Apache Hive JDBC + HiveServer2 implements SSL for plain TCP and HTTP connections it supports both transport modes. While validating the server's certificate during the connection setup, the client in Apache Hive before 1.2.2 and 2.0.x before 2.0.1 doesn't seem to be verifying the common name...

com.hindog.grid:grid-executor-examples_2.11 (>=1.1.0 <=2.0.1) potentially affected by CVE-2017-12625 via org.apache.hive:hive (=2.1.1)

org.apache.hive:hive MAVEN version =2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive and may be impacted: - com.hindog.grid:grid-executor-examples2.11 =1.1.0, =2.0.1 Source cves: CVE-2017-12625 Source advisory:...

org.aksw.sparqlify:sparqlify-cli (=0.8.3), org.aksw.sparqlify:sparqlify-core (=0.8.3) +2 more potentially affected by CVE-2017-12625 via org.apache.hive:hive-service (=2.3.0)

org.apache.hive:hive-service MAVEN version =2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-service and may be impacted: - org.aksw.sparqlify:sparqlify-cli =0.8.3 - org.aksw.sparqlify:sparqlify-core =0.8.3 -...

com.mydataharbor:jdbc-hive-2.2.x-plugin (>=1.1.1 <=2.0.2) potentially affected by CVE-2017-12625 via org.apache.hive:hive-service (=2.2.0)

org.apache.hive:hive-service MAVEN version =2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-service and may be impacted: - com.mydataharbor:jdbc-hive-2.2.x-plugin =1.1.1, =2.0.2 Source cves: CVE-2017-12625 Source advisory:...

com.amazon.emr:hive2-shims (>=5.0.0 <=5.6.0), com.scylladb.alternator:hive2-shims (>=5.6.0 <=5.8.0) potentially affected by CVE-2017-12625 via org.apache.hive:hive-exec (=2.3.0)

org.apache.hive:hive-exec MAVEN version =2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - com.amazon.emr:hive2-shims =5.0.0, =5.6.0, =5.8.0 Source cves: CVE-2017-12625 Source advisory:...

com.dtstack:dt-insight-hive-shade (>=4.1.2-RELEASE <=4.1.3), io.eels:eel-hive_2.11 (=1.0.2) +4 more potentially affected by CVE-2017-12625 via org.apache.hive:hive-exec (=2.1.0)

org.apache.hive:hive-exec MAVEN version =2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - com.dtstack:dt-insight-hive-shade =4.1.2-RELEASE, =2.6.1, =2.6.1, =2.7.1 Source cves: CVE-2017-12625 Source...

com.webank.wedatasphere.dss:dolphinscheduler-prod-metrics (>=1.1.0 <=1.2.2), com.wgzhao.addax:hivereader (>=5.1.0 <=6.0.11) +28 more potentially affected by CVE-2017-12625 via org.apache.hive:hive-service (>=2.1.0 <=2.1.1)

org.apache.hive:hive-service MAVEN version =2.1.0, =1.1.0, =5.1.0, =1.15.4, =1.2.0, =2.0.1, =1.2.0, =1.2.0, =1.2.0, =2.0.1, =2.0.1, =3.0.0, =2.0.0, =3.0.0, =3.0.0, =3.0.6 and more Source cves: CVE-2017-12625 Source advisory: OSV:GHSA-2G9Q-CHQ2-W8QWhttps://vulners.com/osv/OSV:GHSA-2G9Q...

GHSA-2G9Q-CHQ2-W8QW Moderate severity vulnerability that affects org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service

Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be defined on tables or views, e.g., using Apache Ranger. When a view is created over a given table, the policy enforcement does not happen correctly on the table for...

Moderate severity vulnerability that affects org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service

Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be defined on tables or views, e.g., using Apache Ranger. When a view is created over a given table, the policy enforcement does not happen correctly on the table for...

azureml-webservice-schema (>=0.1.57 <=1.0.33), gnuper (=0.0.3) +4 more potentially affected by CVE-2018-11760 via pyspark (>=2.3.0 <=2.3.1)

pyspark PYPI version =2.3.0, =0.1.57, =2.0.3, =0.2.0, =0.2.4 Source cves: CVE-2018-11760 Source advisory: OSV:GHSA-FVXV-9XXR-H7WJ...

azureml-webservice-schema (>=0.1.57 <=1.0.33), gnuper (=0.0.3) +4 more potentially affected by CVE-2018-11760 via pyspark (>=2.3.0 <=2.3.1)

pyspark PYPI version =2.3.0, =0.1.57, =2.0.3, =0.2.0, =0.2.4 Source cves: CVE-2018-11760 Source advisory: OSV:PYSEC-2019-169...