CVE-2015-7521

Related Files

Apache Hive Authorization Bypass

Posted Feb 18, 2016

Authored by Sushanth Sowmyan

Apache Hive fails to perform a particular authorization check. Versions affected include 0.13.x, 0.14.x, 1.0.0 through 1.0.1, 1.1.0 through 1.1.1, and 1.2.0 through 1.2.1.

tags | advisory

advisories | CVE-2015-7521

SHA-256 | c750bc1d41c1a1e9fe5413a40694d6128047b814f4d0961c94e6df37ee0341f9

Download | Favorite | View

Apache Hive 1.0.1 / 1.1.0 / 1.2.1 Authorization Bug Disclosure

Posted Jan 29, 2016

Authored by Sushanth Sowmyan, Olaf Flebbe

Some partition-level operations exist that do not explicitly also authorize privileges of the parent table. This can lead to issues when the parent table would have denied the operation, but no denial occurs because the partition-level privilege is not checked by the authorization framework, which defines authorization entities only from the table level upwards. This issue is known to affect Hive clusters protected by both Ranger as well as SqlStdHiveAuthorization. Apache Hive versions 1.0.0 through 1.0.1, 1.1.0 through 1.1.1, and 1.2.0 through 1.2.1 are affected.

tags | advisory, info disclosure

advisories | CVE-2015-7521

SHA-256 | 1e3f7eddd341045ea6ba03ec5ed1a303d3cb2b39f09dc8a24cf4afaabbfcad13

Download | Favorite | View