GHSA-X2W5-5M2G-7H5M vulnerabilities

Vulnerabilities for packages: hive...

GHSA-9MXF-G3X6-WV74 vulnerabilities

Vulnerabilities for packages: hive...

GHSA-MX9V-GMH4-MGQW vulnerabilities

Vulnerabilities for packages: hive...

GHSA-F9HV-MG5H-XCW9 vulnerabilities

Vulnerabilities for packages: hive...

CVE-2018-19360 vulnerabilities

Vulnerabilities for packages: hive...

CVE-2018-19361 vulnerabilities

Vulnerabilities for packages: hive...

CVE-2018-14721 vulnerabilities

Vulnerabilities for packages: hive...

CVE-2018-14720 vulnerabilities

Vulnerabilities for packages: hive...

Security Bulletin: IBM Security Guardium is affected by a Using Components (Hive-exec) with Known Vulnerabilities vulnerability

Summary IBM Security Guardium has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2018-1284 DESCRIPTION: Apache Hive could allow a remote attacker to bypass security restrictions, caused by an error in the UDF series UDFXPathXXXX. By sending specially crafted XML data, a...

ai.h2o:h2o-orc-parser (>=3.18.0.9 <=3.46.0.11), com.amazon.emr:hive2-shims (>=5.0.0 <=5.6.0) +114 more potentially affected by CVE-2018-11777 via org.apache.hive:hive-exec (>=0.8.0 <=2.3.3)

org.apache.hive:hive-exec MAVEN version =0.8.0, =3.18.0.9, =5.0.0, =1.13.0-rc6, =1.13.0-rc6, =1.13.0-rc6, =1.13.0-rc6, =1.13.0-rc6, =4.1.2-RELEASE, =0.1.1, =4.0.0-preview22.0.1, =1.0.5, =0.1.5, =0.1.5, =0.3.3 and more Source cves: CVE-2018-11777 Source advisory: OSV:GHSA-RRFQ-G5FQ-FC9C...

io.hetu.core:hetu-carbondata (>=1.0.1 <=1.9.0), org.apache.atlas:hive-bridge (>=2.0.0 <=2.2.0) +29 more potentially affected by CVE-2018-11777 via org.apache.hive:hive-exec (>=3.0.0 <=3.1.0)

org.apache.hive:hive-exec MAVEN version =3.0.0, =1.0.1, =2.0.0, =2.0.0, =2.0.0, =2.1.0, =2.0.0, =2.1.0, =2.1.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.1.0 and more Source cves: CVE-2018-11777 Source advisory: OSV:GHSA-RRFQ-G5FQ-FC9C...

Improper Authentication in hive:hive-exec

In Apache Hive 2.3.3, 3.1.0 and earlier, local resources on HiveServer2 machines are not properly protected against malicious user if ranger, sentry or sql standard authorizer is not in use...

com.ge.research.semtk:arangoDbService (=2.2.2), com.ge.research.semtk:athenaService (=2.2.2) +123 more potentially affected by CVE-2018-1314 via org.apache.hive:hive-jdbc (>=0.9.0 <=2.3.2)

org.apache.hive:hive-jdbc MAVEN version =0.9.0, =2.2.1, =2.2.1, =2.2.1, =2.2.2 - com.ge.research.semtk:sparqlGraphResultsService =2.2.2 and more Source cves: CVE-2018-1314 Source advisory: OSV:GHSA-JMF4-PQ78-F8VJ...

com.mydataharbor:jdbc-hive-3.0.x-plugin (>=1.1.1 <=2.0.2), io.hetu.core:hetu-carbondata (>=1.0.1 <=1.9.0) +10 more potentially affected by CVE-2018-1314 via org.apache.hive:hive-jdbc (>=3.0.0 <=3.1.0)

org.apache.hive:hive-jdbc MAVEN version =3.0.0, =1.1.1, =1.0.1, =2.0.0, =3.0.0, =3.0.0, =3.0.0, =0.6.0-incubating, =1.7.0, =1.7.0, =1.11.3 - org.apache.ranger:ranger-hive-plugin =2.0.0 - org.apache.ranger:ranger-hive-plugin-shim =2.0.0 Source cves: CVE-2018-1314 Source advisory:...

GHSA-JMF4-PQ78-F8VJ Moderate severity vulnerability that affects org.apache.hive:hive-jdbc

In Apache Hive 2.3.3, 3.1.0 and earlier, Hive "EXPLAIN" operation does not check for necessary authorization of involved entities in a query. An unauthorized user can do "EXPLAIN" on arbitrary table or view and expose table metadata and statistics...

Moderate severity vulnerability that affects org.apache.hive:hive-jdbc

In Apache Hive 2.3.3, 3.1.0 and earlier, Hive "EXPLAIN" operation does not check for necessary authorization of involved entities in a query. An unauthorized user can do "EXPLAIN" on arbitrary table or view and expose table metadata and statistics...

com.ge.research.semtk:arangoDbService (=2.2.2), com.ge.research.semtk:athenaService (=2.2.2) +123 more potentially affected by CVE-2018-1282 via org.apache.hive:hive-jdbc (>=0.9.0 <=2.3.2)

org.apache.hive:hive-jdbc MAVEN version =0.9.0, =2.2.1, =2.2.1, =2.2.1, =2.2.2 - com.ge.research.semtk:sparqlGraphResultsService =2.2.2 and more Source cves: CVE-2018-1282 Source advisory: OSV:GHSA-JF2M-435M-MXW8...

GHSA-JF2M-435M-MXW8 SQL Injection in hive-jdbc

This vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 allows carefully crafted arguments to be used to bypass the argument escaping/cleanup that JDBC driver does in PreparedStatement implementation...

SQL Injection in hive-jdbc

This vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 allows carefully crafted arguments to be used to bypass the argument escaping/cleanup that JDBC driver does in PreparedStatement implementation...

GHSA-RXMR-C9JM-7MM8 Exposure of Sensitive Information to an Unauthorized Actor in Apache hive

In Apache Hive 0.6.0 to 2.3.2, malicious user might use any xpath UDFs xpath/xpathstring/xpathboolean/xpathnumber/xpathdouble/xpathfloat/xpathlong/xpathint/xpathshort to expose the content of a file on the machine running HiveServer2 owned by HiveServer2 user usually hive if...