Homepage

org.apache.hive:hive-service@4.0.0-beta-1

  • latest version

    4.2.0

  • first published

    14 years ago

  • latest version published

    9 months ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.apache.hive:hive-service package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • C
    Improper Authentication

    org.apache.hive:hive-service is a package for reading, writing, and managing large datasets residing in distributed storage using SQL.

    Affected versions of this package are vulnerable to Improper Authentication through the doSamlAuth process in service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpServlet.java and HiveSamlAuthTokenGenerator in service/src/java/org/apache/hive/service/auth/saml/HiveSamlAuthTokenGenerator.java. An attacker can obtain an authenticated HiveServer2 session as an arbitrary user by sending a forged Authorization: Bearer token to the HTTP /cliservice endpoint when SAML authentication is enabled. The vulnerable code accepted attacker-supplied bearer tokens during SAML HTTP authentication without properly validating the encoded token contents, allowing a remote unauthenticated network attacker to impersonate Hive users. This breaks access control for HiveServer2 HTTP deployments that use native SAML mode, exposing authenticated session access to the attacker.

    How to fix Improper Authentication?

    Upgrade org.apache.hive:hive-service to version 4.2.1 or higher.

    [,4.2.1)
    • H
    Information Exposure

    org.apache.hive:hive-service is a package for reading, writing, and managing large datasets residing in distributed storage using SQL.

    Affected versions of this package are vulnerable to Information Exposure via the verifyAndExtract function of the CookieSigner component. The vulnerability derives due to the exposure of the signed cookie to the end user when there is a mismatch in signature between the current cookie and the expected cookie.

    How to fix Information Exposure?

    Upgrade org.apache.hive:hive-service to version 4.0.0 or higher.

    [1.2.0,4.0.0)
    Go back to all versions of this package