======================================================================

                                   CERT-Renater

                        Note d'Information No. 2024/VULN522
_____________________________________________________________________

DATE                : 06/12/2024

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache Hive versions prior to
                                         4.0.0.

=====================================================================
https://lists.apache.org/thread/ps27l0f85dfcrvqx69c2ootngo96dqbm
_____________________________________________________________________

CVE-2022-41137: Apache Hive: Deserialization of untrusted data when
fetching partitions from the Metastore

Severity: moderate

Affected versions:

- Apache Hive 4.0.0-alpha-1 before 4.0.0

Description:

Apache Hive Metastore (HMS) uses
SerializationUtilities#deserializeObjectWithTypeInformation method
when filtering and fetching partitions that is unsafe and can lead
to Remote Code Execution (RCE) since it allows the deserialization
of arbitrary data.

In real deployments, the vulnerability can be exploited only by
authenticated users/clients that were able to successfully
establish a connection to the Metastore. From an API perspective
any code that calls the unsafe method may be vulnerable unless it
performs additional prerechecks on the input arguments.


This issue is being tracked as HIVE-26539

Credit:

Junjie Liao (reporter)


References:

https://github.com/apache/hive
https://issues.apache.org/jira/browse/HIVE-26539
https://github.com/apache/hive/commit/60027bb9c91a93affcfebd9068f064bc1f2a74c9
https://hive.apache.org/
https://www.cve.org/CVERecord?id=CVE-2022-41137
https://issues.apache.org/jira/browse/HIVE-26539




=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================