Vulnerability-Lookup

GHSA-V3P8-J597-3XG8

Vulnerability from github – Published: 2022-07-17 00:00 – Updated: 2022-07-22 16:28

Summary

Apache Hive before 3.1.3 `CREATE` and `DROP` function operations do not check for necessary authorization.

Details

Apache Hive before 3.1.3 CREATE and DROP function operations do not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged users to drop and recreate UDFs pointing them to new jars that could be potentially malicious.

Severity ?

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.hive:hive"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-34538"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-21T21:37:21Z",
    "nvd_published_at": "2022-07-16T07:15:00Z",
    "severity": "HIGH"
  },
  "details": "Apache Hive before 3.1.3 `CREATE` and `DROP` function operations do not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged users to drop and recreate UDFs pointing them to new jars that could be potentially malicious.",
  "id": "GHSA-v3p8-j597-3xg8",
  "modified": "2022-07-22T16:28:26Z",
  "published": "2022-07-17T00:00:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34538"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/hive"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/oqqgnhz4c6nxsfd0xstosnk0g15f7354"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Apache Hive before 3.1.3 `CREATE` and `DROP` function operations do not check for necessary authorization."
}

CVE-2021-34538 (GCVE-0-2021-34538)

Vulnerability from cvelistv5 – Published: 2022-07-16 07:10 – Updated: 2024-08-04 00:12

Title

Apache Hive Security vulnerability in Hive with UDFs

Summary

Apache Hive before 3.1.3 "CREATE" and "DROP" function operations does not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged users to drop and recreate UDFs pointing them to new jars that could be potentially malicious.

Severity ?

No CVSS data available.

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

apache

References

URL

Tags

https://lists.apache.org/thread/oqqgnhz4c6nxsfd0x…

x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache Hive	Affected: Apache Hive , < 3.1.3 (custom)

Credits

This vulnerability was discovered and reported by Hideyuki Furue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T00:12:50.447Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/oqqgnhz4c6nxsfd0xstosnk0g15f7354"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache Hive",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "3.1.3",
              "status": "affected",
              "version": "Apache Hive",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "This vulnerability was discovered and reported by Hideyuki Furue."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache Hive before 3.1.3 \"CREATE\" and \"DROP\" function operations does not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged users to drop and recreate UDFs pointing them to new jars that could be potentially malicious."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "other": "Very Important"
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306 Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-07-16T07:10:09",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.apache.org/thread/oqqgnhz4c6nxsfd0xstosnk0g15f7354"
        }
      ],
      "source": {
        "defect": [
          "HIVE-25468",
          ""
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Apache Hive Security vulnerability in Hive with UDFs",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2021-34538",
          "STATE": "PUBLIC",
          "TITLE": "Apache Hive Security vulnerability in Hive with UDFs"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache Hive",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "Apache Hive",
                            "version_value": "3.1.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "This vulnerability was discovered and reported by Hideyuki Furue."
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Apache Hive before 3.1.3 \"CREATE\" and \"DROP\" function operations does not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged users to drop and recreate UDFs pointing them to new jars that could be potentially malicious."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": [
          {
            "other": "Very Important"
          }
        ],
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-306 Missing Authentication for Critical Function"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://lists.apache.org/thread/oqqgnhz4c6nxsfd0xstosnk0g15f7354",
              "refsource": "MISC",
              "url": "https://lists.apache.org/thread/oqqgnhz4c6nxsfd0xstosnk0g15f7354"
            }
          ]
        },
        "source": {
          "defect": [
            "HIVE-25468",
            ""
          ],
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2021-34538",
    "datePublished": "2022-07-16T07:10:09",
    "dateReserved": "2021-06-10T00:00:00",
    "dateUpdated": "2024-08-04T00:12:50.447Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-V3P8-J597-3XG8

CVE-2021-34538 (GCVE-0-2021-34538)

Tags

Sightings

Nomenclature