[SECURITY] CVE-2018-1314: Hive explain query not being authorized

Discussion:

Daniel Dai

2018-11-07 21:24:03 UTC

CVE-2018-1314: Hive explain query not being authorized

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected: This vulnerability affects all versions of Hive,
including 2.3.3, 3.1.0 and earlier

Description: Hive "EXPLAIN" operation does not check for necessary
authorization of involved entities in a query. An unauthorized user
can do "EXPLAIN" on arbitrary table or view and expose table metadata
and statistics.

Mitigation: all Hive users shall upgrade to 2.3.4 or 3.1.1 or later

Terry

2018-11-07 21:38:37 UTC

Permalink

Daniel - Is this happening when beeline security is enabled? Can you
provide a link for more info on this?

Post by Daniel Dai
CVE-2018-1314: Hive explain query not being authorized
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected: This vulnerability affects all versions of Hive,
including 2.3.3, 3.1.0 and earlier
Description: Hive "EXPLAIN" operation does not check for necessary
authorization of involved entities in a query. An unauthorized user
can do "EXPLAIN" on arbitrary table or view and expose table metadata
and statistics.
Mitigation: all Hive users shall upgrade to 2.3.4 or 3.1.1 or later

Thejas Nair

2018-11-09 21:12:56 UTC

Permalink

Terry, Yes this is seen with SQL stardard authorization, Ranger and I
suppose Sentry based authorization as well.
Hive was not passing the table objects to the authorization plugin
implementations during authorization api calls.

Daniel - Is this happening when beeline security is enabled? Can you provide a link for more info on this?