GitHub Advisoryadvisory · Maven

GHSA-jf2m-435m-mxw8 SQL Injection in hive-jdbc

CRITICAL Published 2018-11-21 Modified 2024-04-19 Official page ↗
Aliases
CVE-2018-1282
Ecosystem
Maven
Packages
org.apache.hive:hive-jdbc
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-89
Reviewed
2020-06-16

Affected packages

• Maven org.apache.hive:hive-jdbc: >= 0.7.1, < 2.3.3 → fixed in 2.3.3

Description

This vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 allows carefully crafted arguments to be used to bypass the argument escaping/cleanup that JDBC driver does in PreparedStatement implementation.

Related

Alias · CVE (1)

  • CVE-2018-1282 This vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 allows carefully crafted arguments to be used to bypass the argument… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References