Apache Hive before 3.1.3 `CREATE` and `DROP` function operations do not check for necessary authorization.

高 7.5CVE-2021-34538 · GHSA-v3p8-j597-3xg8 · 16/07/2022 公開 · 17/06/2026 更新

要点

CVE-2021-34538 は org.apache.hive:hive, hive (apache) に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.9%（全脆弱性の 79.2% より高い）。
対処：3.1.3 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.apache.hive:hive Maven	`< 3.1.3`	`3.1.3`
hive apache	`< 3.1.3`	`3.1.3`

概要

Apache Hive before 3.1.3 CREATE and DROP function operations do not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged users to drop and recreate UDFs pointing them to new jars that could be potentially malicious.

NVD の説明

Apache Hive before 3.1.3 "CREATE" and "DROP" function operations does not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged users to drop and recreate UDFs pointing them to new jars that could be potentially malicious.