CVE-2018-11777 - In Apache Hive 2.3.3, 3.1.0 and earlier, local resources on HiveServer2 machines are not properly protected against malicious user if ranger, sentry or sql standard authorizer is not in use

Back Back to CVE browser

HIGH

In Apache Hive 2.3.3, 3.1.0 and earlier, local resources on HiveServer2 machines are not properly protected against malicious user if ranger, sentry or sql standard authorizer is not in use

Published Nov 8, 2018

8.1

HIGH

CVSS 3.0

EPSS 2.30%

Description

In Apache Hive 2.3.3, 3.1.0 and earlier, local resources on HiveServer2 machines are not properly protected against malicious user if ranger, sentry or sql standard authorizer is not in use.

Affected products

Vendor Apache Software Foundation Product Apache Hive Default
unknown
Affected
- All versions of Hive, including 2.3.3, 3.1.0 and earlier

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Apache Software Foundation	Apache Hive	unknown	Affected All versions of Hive, including 2.3.3, 3.1.0 and earlier

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (6)

http://www.securityfocus.com/bid/105886
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-0775
Advisory
https://github.com/advisories/GHSA-rrfq-g5fq-fc9c
Advisory
https://lists.apache.org/thread.html/963c8e2516405c9b532b4add16c03b2c5db621e0c83e80f45049cbbb%40%3Cdev.hive.apache.org%3E
x_refsource_MISC
https://lists.apache.org/thread.html/963c8e2516405c9b532b4add16c03b2c5db621e0c83e80f45049cbbb@%3Cdev.hive.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2018-11777

Link	Providers	Tags
http://www.securityfocus.com/bid/105886		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-0775		Advisory
https://github.com/advisories/GHSA-rrfq-g5fq-fc9c		Advisory
https://lists.apache.org/thread.html/963c8e2516405c9b532b4add16c03b2c5db621e0c83e80f45049cbbb%40%3Cdev.hive.apache.org%3E		x_refsource_MISC
https://lists.apache.org/thread.html/963c8e2516405c9b532b4add16c03b2c5db621e0c83e80f45049cbbb@%3Cdev.hive.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2018-11777