GitHub Advisoryadvisory · Maven

GHSA-5gvm-hrw5-h6xf Improper Authentication in org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service

HIGH Published 2019-03-14 Modified 2022-09-17 Official page ↗
Aliases
CVE-2015-1772
Ecosystem
Maven
Packages
org.apache.hive:hive, org.apache.hive:hive-exec, org.apache.hive:hive-service
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-287
Reviewed
2020-06-16

Affected packages

• Maven org.apache.hive:hive: >= 1.0.0, < 1.0.1 → fixed in 1.0.1 • Maven org.apache.hive:hive: >= 1.1.0, < 1.1.1 → fixed in 1.1.1 • Maven org.apache.hive:hive-exec: >= 1.0.0, < 1.0.1 → fixed in 1.0.1 • Maven org.apache.hive:hive-exec: >= 1.1.0, < 1.1.1 → fixed in 1.1.1 • Maven org.apache.hive:hive-service: >= 1.0.0, < 1.0.1 → fixed in 1.0.1 • Maven org.apache.hive:hive-service: >= 1.1.0, < 1.1.1 → fixed in 1.1.1

Description

The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, mishandles simple unauthenticated and anonymous bind configurations, which allows remote attackers to bypass authentication via a crafted LDAP request.

Related

Alias · CVE (1)

  • CVE-2015-1772 The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0,… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References