Vulnerability · Published Dec 5, 2024 · Assigned by apache
CVE-2022-41137Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore
High 8.3
In plain English
A high-severity unsafe deserialization in Apache Hive from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 77% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe and can lead to Remote Code Execution (RCE) since it allows the deserialization of arbitrary data. In real deployments, the vulnerability can be exploited only by authenticated users/clients that were able to successfully establish a connection to the Metastore. From an API perspective any code that calls the unsafe method may be vulnerable unless it performs additional prerechecks on the input arguments.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.hive:hive-exec | 4.0.0-alpha-2 | GHSA-6hqr-c69m-r76q |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Hive | 4.0.0-alpha-1 – before 4.0.0 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
References
- https://github.com/apache/hive product
- https://issues.apache.org/jira/browse/HIVE-26539 issue-tracking
- https://github.com/apache/hive/commit/60027bb9c91a93affcfebd9068f064bc1f2a74c9 patch
- https://lists.apache.org/thread/jwtr3d9yovf2wo0qlxvkhoxnwxxyzgts vendor-advisory
- http://www.openwall.com/lists/oss-security/2024/12/04/2