Access Restriction Bypass Affecting org.apache.ranger:ranger-hive-utils package, versions [,0.7.1)


Severity

Recommended
0.0
medium
0
10

CVSS assessment by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.33% (55th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Access Restriction Bypass vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-JAVA-ORGAPACHERANGER-31476
  • published31 Aug 2017
  • disclosed6 Jun 2017
  • creditUnknown

Introduced: 6 Jun 2017

CVE-2017-7677  (opens in a new tab)
CWE-20  (opens in a new tab)

How to fix?

Upgrade org.apache.ranger:ranger-hive-utils to version 0.7.1 or higher.

Overview

org.apache.ranger:ranger-hive-utils is a framework to enable, monitor and manage comprehensive data security across the Hadoop platform.

Affected versions of the package are vulnerable to Access Restriction Bypass. In environments that use external location for hive tables, Hive Authorizer in Apache Ranger before 0.7.1 should be checking RWX permission for create table.

CVSS Base Scores

version 3.1