org.apache.hive:hive-jdbc@4.0.0-alpha-1 vulnerabilities
latest version
4.0.1
latest non vulnerable version
first published
13 years ago
latest version published
2 months ago
licenses detected
- [0.8.0,)
package manager
Direct Vulnerabilities
Known vulnerabilities in the org.apache.hive:hive-jdbc package. This does not include vulnerabilities belonging to this package’s dependencies.
How to fix?
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
Affected versions of this package are vulnerable to Improper Control of Generation of Code ('Code Injection') in the JDBC driver component due to improper URL validation. An attacker can exploit this vulnerability on a machine/endpoint where the JDBC driver (client) is running by setting up a malicious HTTP server and specifying a JDBC URL pointing towards this server. When a JDBC connection is attempted, the malicious HTTP server can provide a special response with a customized payload that triggers the execution of certain commands in the JDBC client. Note Exploiting this vulnerability is only possible if the malicious user has sufficient permissions to specify/edit JDBC URLs in an endpoint relying on the Hive JDBC driver and the JDBC client process runs under a privileged user. How to fix Improper Control of Generation of Code ('Code Injection')? Upgrade | [4.0.0-alpha-1,4.0.0) |