Apache Software Foundation Apache Hive
18 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-49845 | 4.0.0 – 4.2.0 | Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths | CRITICAL 9.8 | 0.9 % | ||
| CVE-2026-55976 | 2.1.0 – 4.2.0 | Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url | CRITICAL 9.1 | 1.0 % | ||
| CVE-2026-53561 | 4.0.0 – 4.2.0 | Apache Hive: Unauthenticated authentication bypass in HiveServer2 HTTP SAML bearer-token validation allows impersonation of any Hive user | HIGH 7.4 | 0.3 % | ||
| CVE-2025-62728 | 4.1.0 – < 4.2.0 | Apache Hive: SQL injection vulnerability when processing delete column statistics requests via the HMS Thrift APIs | MEDIUM 5.4 | 0.4 % | ||
| CVE-2024-29869 | 1.1.0 – < 4.0.1 | Apache Hive: Credentials file created with non restrictive permissions | MEDIUM 5.5 | 0.3 % | ||
| CVE-2024-23953 | 2.2.0 – < 4.0.0 | Apache Hive: Timing Attack Against Signature in LLAP util | MEDIUM 6.5 | 1.3 % | ||
| CVE-2024-23945 | 1.2.0 – < 4.0.0 | Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification fails | MEDIUM 5.9 | 1.6 % | ||
| CVE-2022-41137 | 4.0.0-alpha-1 – < 4.0.0 | Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore | HIGH 8.3 | 1.6 % | ||
| CVE-2023-35701 | 4.0.0-alpha-1 – < 4.0.0 | Apache Hive: Arbitrary command execution via JDBC driver | MEDIUM 6.6 | 1.1 % | ||
| CVE-2021-34538 | Apache Hive – < 3.1.3 | Apache Hive Security vulnerability in Hive with UDFs | HIGH 7.5 | 1.9 % | ||
| CVE-2020-1926 | Apache Hive – < 2.3.8 | Timing attack in Cookie signature verification | MEDIUM 5.9 | 2.5 % | ||
| CVE-2018-1314 | All versions of Hive including 2.3.3, 3.1.0 and earlier | In Apache Hive 2.3.3, 3.1.0 and earlier, Hive "EXPLAIN" operation does not check for necessary authorization of involved entities in a query | MEDIUM 4.3 | 2.0 % | ||
| CVE-2018-11777 | All versions of Hive, including 2.3.3, 3.1.0 and earlier | In Apache Hive 2.3.3, 3.1.0 and earlier, local resources on HiveServer2 machines are not properly protected against malicious user if ranger | HIGH 8.1 | 2.3 % | ||
| CVE-2018-1315 | 2.1.0 to 2.3.2 | In Apache Hive 2.1.0 to 2.3.2, when 'COPY FROM FTP' statement is run using HPL/SQL extension to Hive, a compromised/malicious FTP server can | LOW 3.7 | 1.7 % | ||
| CVE-2018-1284 | 0.6.0 to 2.3.2 | In Apache Hive 0.6.0 to 2.3.2, malicious user might use any xpath UDFs (xpath/xpath_string/xpath_boolean/xpath_number/xpath_double/xpath_flo | LOW 3.7 | 2.1 % | ||
| CVE-2018-1282 | 0.7.1 to 2.3.2 | This vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 allows carefully crafted arguments to be used to bypass the argument escaping/c | CRITICAL 9.1 | 5.5 % | ||
| CVE-2017-12625 | 2.1.x before 2.1.2 ; 2.2.x before 2.2.1 ; 2.3.0 | Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be defined | MEDIUM 4.3 | 1.4 % | ||
| CVE-2016-3083 | 0.11.0 - 0.14.0 ; 1.0.0 - 1.2.1 ; 2.0.0 | Apache Hive (JDBC + HiveServer2) implements SSL for plain TCP and HTTP connections (it supports both transport modes). While validating the | HIGH 7.5 | 1.0 % |