Apache Hive before 3.1.3 `CREATE` and `DROP` function operations do not check for necessary authorization.

CAO 7.5CVE-2021-34538 · GHSA-v3p8-j597-3xg8 · Công bố 16/07/2022 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2021-34538 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng org.apache.hive:hive, hive (apache).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.9%, cao hơn 79.2% các lỗ hổng khác.
Cách xử lý: cập nhật lên 3.1.3 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
org.apache.hive:hive Maven	`< 3.1.3`	`3.1.3`
hive apache	`< 3.1.3`	`3.1.3`

Mô tả

Apache Hive before 3.1.3 CREATE and DROP function operations do not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged users to drop and recreate UDFs pointing them to new jars that could be potentially malicious.

Mô tả của NVD

Apache Hive before 3.1.3 "CREATE" and "DROP" function operations does not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged users to drop and recreate UDFs pointing them to new jars that could be potentially malicious.