Vulnerability details

CVE-2022-41137

Apache hiveApache Software Foundation Apache Hive

Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore

CVSS 3.1

8.3High

Official description

Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe and can lead to Remote Code Execution (RCE) since it allows the deserialization of arbitrary data. In real deployments, the vulnerability can be exploited only by authenticated users/clients that were able to successfully establish a connection to the Metastore. From an API perspective any code that calls the unsafe method may be vulnerable unless it performs additional prerechecks on the input arguments.

CVSS scores

Score	Version	Source	Vector
8.3High	3.1	CISA ADP / Vulnrichment (CISA-ADP)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
Apache	hive	4.0.0-alpha-1 ≤ v < 4.0.0	CISA ADP / Vulnrichment
Apache Software Foundation	Apache Hive	4.0.0-alpha-1 ≤ v < 4.0.0	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/apache/hive product
https://issues.apache.org/jira/browse/HIVE-26539 issue-tracking
https://github.com/apache/hive/commit/60027bb9c91a93affcfebd9068f064bc1f2a74c9 patch
https://lists.apache.org/thread/jwtr3d9yovf2wo0qlxvkhoxnwxxyzgts vendor-advisory
http://www.openwall.com/lists/oss-security/2024/12/04/2

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2024-12-05
Last updated: 2024-12-05
State: Published
Assigner (CNA): apache

Exploit prediction (EPSS)

1.64%

Probability of exploitation in 30 days

76.5%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-502
Deserialization of Untrusted Data