Vulnerability · Published Jan 28, 2025 · Assigned by apache
CVE-2024-29869Apache Hive: Credentials file created with non restrictive permissions
Medium 5.5
In plain English
A medium-severity incorrect permission assignment in Apache Hive from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly. Any unauthorized user having access to the directory can read the sensitive information written into this file. Users are recommended to upgrade to version 4.0.1, which fixes this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.hive:hive-exec | 4.0.1 | GHSA-c476-j253-5rgq |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Hive | 1.1.0 – before 4.0.1 |
Weakness: CWE-732 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/apache/hive product
- https://github.com/apache/hive/commit/20106e254527f7d71b2e34455c4322e14950c620 patch
- https://issues.apache.org/jira/browse/HIVE-28134 issue-tracking
- https://lists.apache.org/thread/h27ohpyrqf9w1m3c0tqr7x8jg59rcrv6 vendor-advisory
- http://www.openwall.com/lists/oss-security/2025/01/28/4