org.apache.hive:hive-standalone-metastore-server@4.0.0-alpha-1 vulnerabilities
latest version
4.1.0
first published
3 years ago
latest version published
4 months ago
licenses detected
- [4.0.0-alpha-1,)
package registry
Direct Vulnerabilities
Known vulnerabilities in the org.apache.hive:hive-standalone-metastore-server package. This does not include vulnerabilities belonging to this package’s dependencies.
Fix vulnerabilities automatically
Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
Affected versions of this package are vulnerable to SQL Injection via the processing of delete column statistics requests through the HMS Thrift APIs. An attacker can execute arbitrary SQL commands by sending specially crafted requests to the affected API endpoints. This is only exploitable if the attacker is a trusted or authorized user/application with direct access to the Thrift APIs, and if the How to fix SQL Injection? Upgrade | [,4.2.0) |
Affected versions of this package are vulnerable to Deserialization of Untrusted Data through the Note: This is only exploitable if the attacker is an authenticated user who has successfully established a connection to the Metastore. How to fix Deserialization of Untrusted Data? Upgrade | [4.0.0-alpha-1,4.0.0-alpha-2) |