CVE-2022-41137

CVE-2022-41137 describes a vulnerability in Apache Hive Metastore (HMS) where the call to SerializationUtilities#deserializeObjectWithTypeInformation during filtering/fetching partitions is unsafe and can lead to remote code execution (RCE) via deserializing arbitrary data. The exploit requires a...

CVE-2015-7521

The CVE-2015-7521 entry concerns Apache Hive (versions 1.0.0–1.2.1) run on clusters protected by Ranger and SqlStdHiveAuthorization. It describes an authorization bypass where partition-level operations can grant access that should be denied at the parent table level, effectively bypassing parent...

CVE-2018-11777

CVE-2018-11777 affects Apache Hive (HiveServer2). In HiveServer2, local resources are not properly protected against a malicious user when the Ranger, Sentry, or SQL standard authorizer is not in use, across Hive versions 2.3.3, 3.1.0 and earlier. The root cause is insufficient protection of loca...