Apache Hive
Monthly
SQL injection in the Apache Hive Metastore (versions 4.0.0 through 4.2.0) lets a caller who can invoke partition-name Metastore RPCs manipulate the generated WHERE clause so operations intended for one partition match additional rows in the same table. Because client-supplied partition names are concatenated into direct-SQL statements instead of bound as parameters, a crafted name containing a single quote can redirect reads, statistics updates, truncate/drop targets, and file-metadata cache operations to unintended partitions. No public exploit is identified at time of analysis and the flaw is not in CISA KEV; the input assigns CVSS 9.8, but the vendor description constrains impact to partition targeting within referenceable tables rather than arbitrary cross-database access.
Server-side request forgery in Apache Hive versions 2.1.0 through 4.2.0 lets an authenticated user with CREATE TABLE rights coerce the HiveServer2/Metastore process into fetching an attacker-chosen URL by planting a crafted avro.schema.url table property on an Avro table that is later queried. The fetch runs with the Hive service identity, exposing cloud instance metadata (e.g. 169.254.169.254), internal-only network services, and local files. No public exploit is identified at time of analysis and EPSS is low (0.29%), but the CVSS 9.1 rating and low attack complexity make it a meaningful post-authentication risk; upgrade to 4.2.1 resolves it.
Authentication bypass in Apache HiveServer2 4.0.0-4.2.0 allows unauthenticated network attackers to impersonate any Hive user and obtain a fully authenticated HiveServer2 session when SAML mode is enabled over HTTP transport. The root cause is an inverted HMAC signature comparison in HiveSamlAuthTokenGenerator.java - the original code used !MessageDigest.isEqual(), causing all tokens to pass validation regardless of signature correctness, meaning a forged bearer token with any embedded username is unconditionally accepted. No CISA KEV listing and an EPSS of 0.14% (4th percentile) indicate no confirmed active exploitation at time of analysis, but the logic flaw is trivially exploitable once the deployment condition is met.
SQL injection in the Apache Hive Metastore (versions 4.0.0 through 4.2.0) lets a caller who can invoke partition-name Metastore RPCs manipulate the generated WHERE clause so operations intended for one partition match additional rows in the same table. Because client-supplied partition names are concatenated into direct-SQL statements instead of bound as parameters, a crafted name containing a single quote can redirect reads, statistics updates, truncate/drop targets, and file-metadata cache operations to unintended partitions. No public exploit is identified at time of analysis and the flaw is not in CISA KEV; the input assigns CVSS 9.8, but the vendor description constrains impact to partition targeting within referenceable tables rather than arbitrary cross-database access.
Server-side request forgery in Apache Hive versions 2.1.0 through 4.2.0 lets an authenticated user with CREATE TABLE rights coerce the HiveServer2/Metastore process into fetching an attacker-chosen URL by planting a crafted avro.schema.url table property on an Avro table that is later queried. The fetch runs with the Hive service identity, exposing cloud instance metadata (e.g. 169.254.169.254), internal-only network services, and local files. No public exploit is identified at time of analysis and EPSS is low (0.29%), but the CVSS 9.1 rating and low attack complexity make it a meaningful post-authentication risk; upgrade to 4.2.1 resolves it.
Authentication bypass in Apache HiveServer2 4.0.0-4.2.0 allows unauthenticated network attackers to impersonate any Hive user and obtain a fully authenticated HiveServer2 session when SAML mode is enabled over HTTP transport. The root cause is an inverted HMAC signature comparison in HiveSamlAuthTokenGenerator.java - the original code used !MessageDigest.isEqual(), causing all tokens to pass validation regardless of signature correctness, meaning a forged bearer token with any embedded username is unconditionally accepted. No CISA KEV listing and an EPSS of 0.14% (4th percentile) indicate no confirmed active exploitation at time of analysis, but the logic flaw is trivially exploitable once the deployment condition is met.