oss-sec mailing list archives
[SECURITY] CVE-2018-1314: Hive explain query not being authorized
From: Daniel Dai <daijy () apache org>
Date: Wed, 7 Nov 2018 13:24:03 -0800
CVE-2018-1314: Hive explain query not being authorized Severity: Important Vendor: The Apache Software Foundation Versions Affected: This vulnerability affects all versions of Hive, including 2.3.3, 3.1.0 and earlier Description: Hive "EXPLAIN" operation does not check for necessary authorization of involved entities in a query. An unauthorized user can do "EXPLAIN" on arbitrary table or view and expose table metadata and statistics. Mitigation: all Hive users shall upgrade to 2.3.4 or 3.1.1 or later
Current thread:
- [SECURITY] CVE-2018-1314: Hive explain query not being authorized Daniel Dai (Nov 08)