org.apache.hive:hive-standalone-metastore-server 4.0.0-alpha-2

Direct Vulnerabilities

Known vulnerabilities in the org.apache.hive:hive-standalone-metastore-server package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Arbitrary Code Injection Affected versions of this package are vulnerable to Arbitrary Code Injection through the direct-SQL partition-name resolution paths in `DirectSqlUpdatePart.getPartitionInfo()` and `MetaStoreDirectSql.getPartitionsByNames()`. An attacker can cause metastore RPCs to target unintended partitions by supplying crafted partition names in requests when direct SQL is enabled. This can make partition lookups, statistics updates, truncation operations, and file-metadata cache actions operate on the wrong rows, letting an authenticated user read or modify partition metadata for partitions they should not affect. How to fix Arbitrary Code Injection? Upgrade `org.apache.hive:hive-standalone-metastore-server` to version 4.2.1 or higher.	[,4.2.1)
H SQL Injection Affected versions of this package are vulnerable to SQL Injection via the processing of delete column statistics requests through the HMS Thrift APIs. An attacker can execute arbitrary SQL commands by sending specially crafted requests to the affected API endpoints. This is only exploitable if the attacker is a trusted or authorized user/application with direct access to the Thrift APIs, and if the `metastore.try.direct.sql` property is set to true. How to fix SQL Injection? Upgrade `org.apache.hive:hive-standalone-metastore-server` to version 4.2.0 or higher.	[,4.2.0)

Vulnerability

Vulnerable Version

Arbitrary Code Injection

Affected versions of this package are vulnerable to Arbitrary Code Injection through the direct-SQL partition-name resolution paths in DirectSqlUpdatePart.getPartitionInfo() and MetaStoreDirectSql.getPartitionsByNames(). An attacker can cause metastore RPCs to target unintended partitions by supplying crafted partition names in requests when direct SQL is enabled. This can make partition lookups, statistics updates, truncation operations, and file-metadata cache actions operate on the wrong rows, letting an authenticated user read or modify partition metadata for partitions they should not affect.

How to fix Arbitrary Code Injection?

Upgrade org.apache.hive:hive-standalone-metastore-server to version 4.2.1 or higher.

[,4.2.1)

SQL Injection

Affected versions of this package are vulnerable to SQL Injection via the processing of delete column statistics requests through the HMS Thrift APIs. An attacker can execute arbitrary SQL commands by sending specially crafted requests to the affected API endpoints. This is only exploitable if the attacker is a trusted or authorized user/application with direct access to the Thrift APIs, and if the metastore.try.direct.sql property is set to true.

How to fix SQL Injection?

Upgrade org.apache.hive:hive-standalone-metastore-server to version 4.2.0 or higher.

[,4.2.0)

org.apache.hive:hive-standalone-metastore-server@4.0.0-alpha-2

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically