Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore

高 8.3CVE-2022-41137 · GHSA-6hqr-c69m-r76q · 05/12/2024 公開 · 17/06/2026 更新

要点

CVE-2022-41137 は org.apache.hive:hive-exec, hive (apache) に影響する深刻度「高」 (CVSS 8.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.6%（全脆弱性の 76.4% より高い）。
対処：4.0.0-alpha-2 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.apache.hive:hive-exec Maven	`≥ 4.0.0-alpha-1, < 4.0.0-alpha-2`	`4.0.0-alpha-2`
hive apache	`= 4.0.0`	修正版なし

概要

In real deployments, the vulnerability can be exploited only by authenticated users/clients that were able to successfully establish a connection to the Metastore. From an API perspective any code that calls the unsafe method may be vulnerable unless it performs additional prerechecks on the input arguments.

NVD の説明

Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe and can lead to Remote Code Execution (RCE) since it allows the deserialization of arbitrary data. In real deployments, the vulnerability can be exploited only by authenticated users/clients that were able to successfully establish a connection to the Metastore. From an API perspective any code that calls the unsafe method may be vulnerable unless it performs additional prerechecks on the input arguments.