cve-2022-41137
Vulnerability from cvelistv5
Published
2024-12-05 10:01
Modified
2024-12-05 17:02
Severity ?
Summary
Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe and can lead to Remote Code Execution (RCE) since it allows the deserialization of arbitrary data. In real deployments, the vulnerability can be exploited only by authenticated users/clients that were able to successfully establish a connection to the Metastore. From an API perspective any code that calls the unsafe method may be vulnerable unless it performs additional prerechecks on the input arguments.
References
security@apache.orghttps://github.com/apache/hive
security@apache.orghttps://github.com/apache/hive/commit/60027bb9c91a93affcfebd9068f064bc1f2a74c9
security@apache.orghttps://issues.apache.org/jira/browse/HIVE-26539
security@apache.orghttps://lists.apache.org/thread/jwtr3d9yovf2wo0qlxvkhoxnwxxyzgts
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2024/12/04/2
Impacted products
Vendor Product Version
Apache Software Foundation Apache Hive Version: 4.0.0-alpha-1   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-12-05T10:03:34.734Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2024/12/04/2"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:apache:hive:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "hive",
            "vendor": "apache",
            "versions": [
              {
                "lessThan": "4.0.0",
                "status": "affected",
                "version": "4.0.0-alpha-1",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "LOW",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-41137",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-05T17:00:40.730056Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-05T17:02:05.659Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.hive:hive-exec",
          "product": "Apache Hive",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "4.0.0",
              "status": "affected",
              "version": "4.0.0-alpha-1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Junjie Liao"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Apache Hive\u0026nbsp;Metastore (HMS) uses\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSerializationUtilities#deserializeObjectWithTypeInformation\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;method when filtering and fetching partitions that is unsafe and\u003c/span\u003e\u0026nbsp;can lead\u0026nbsp;to Remote Code Execution (RCE) since it allows the deserialization of arbitrary data.\u003cbr\u003e\u003cbr\u003eIn real deployments, the vulnerability can be exploited only by authenticated users/clients that were able to successfully establish\u0026nbsp;a connection to the Metastore. From an API perspective any code that calls the unsafe method may be vulnerable unless it performs additional prerechecks on the input arguments."
            }
          ],
          "value": "Apache Hive\u00a0Metastore (HMS) uses\u00a0SerializationUtilities#deserializeObjectWithTypeInformation\u00a0method when filtering and fetching partitions that is unsafe and\u00a0can lead\u00a0to Remote Code Execution (RCE) since it allows the deserialization of arbitrary data.\n\nIn real deployments, the vulnerability can be exploited only by authenticated users/clients that were able to successfully establish\u00a0a connection to the Metastore. From an API perspective any code that calls the unsafe method may be vulnerable unless it performs additional prerechecks on the input arguments."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-05T10:01:41.692Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/apache/hive"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://issues.apache.org/jira/browse/HIVE-26539"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/apache/hive/commit/60027bb9c91a93affcfebd9068f064bc1f2a74c9"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/jwtr3d9yovf2wo0qlxvkhoxnwxxyzgts"
        }
      ],
      "source": {
        "defect": [
          "HIVE-26539"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2022-41137",
    "datePublished": "2024-12-05T10:01:41.692Z",
    "dateReserved": "2022-09-20T14:55:51.817Z",
    "dateUpdated": "2024-12-05T17:02:05.659Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-41137\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2024-12-05T10:15:04.450\",\"lastModified\":\"2024-12-05T17:15:07.033\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Apache Hive\u00a0Metastore (HMS) uses\u00a0SerializationUtilities#deserializeObjectWithTypeInformation\u00a0method when filtering and fetching partitions that is unsafe and\u00a0can lead\u00a0to Remote Code Execution (RCE) since it allows the deserialization of arbitrary data.\\n\\nIn real deployments, the vulnerability can be exploited only by authenticated users/clients that were able to successfully establish\u00a0a connection to the Metastore. From an API perspective any code that calls the unsafe method may be vulnerable unless it performs additional prerechecks on the input arguments.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H\",\"baseScore\":8.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.5}]},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-502\"}]}],\"references\":[{\"url\":\"https://github.com/apache/hive\",\"source\":\"security@apache.org\"},{\"url\":\"https://github.com/apache/hive/commit/60027bb9c91a93affcfebd9068f064bc1f2a74c9\",\"source\":\"security@apache.org\"},{\"url\":\"https://issues.apache.org/jira/browse/HIVE-26539\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread/jwtr3d9yovf2wo0qlxvkhoxnwxxyzgts\",\"source\":\"security@apache.org\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2024/12/04/2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2024/12/04/2\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-12-05T10:03:34.734Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-41137\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-12-05T17:00:40.730056Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:apache:hive:*:*:*:*:*:*:*:*\"], \"vendor\": \"apache\", \"product\": \"hive\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.0.0-alpha-1\", \"lessThan\": \"4.0.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-12-05T16:58:51.448Z\"}}], \"cna\": {\"title\": \"Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore\", \"source\": {\"defect\": [\"HIVE-26539\"], \"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Junjie Liao\"}], \"metrics\": [{\"other\": {\"type\": \"Textual description of severity\", \"content\": {\"text\": \"moderate\"}}}], \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache Hive\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.0.0-alpha-1\", \"lessThan\": \"4.0.0\", \"versionType\": \"semver\"}], \"packageName\": \"org.apache.hive:hive-exec\", \"collectionURL\": \"https://repo.maven.apache.org/maven2\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/apache/hive\", \"tags\": [\"product\"]}, {\"url\": \"https://issues.apache.org/jira/browse/HIVE-26539\", \"tags\": [\"issue-tracking\"]}, {\"url\": \"https://github.com/apache/hive/commit/60027bb9c91a93affcfebd9068f064bc1f2a74c9\", \"tags\": [\"patch\"]}, {\"url\": \"https://lists.apache.org/thread/jwtr3d9yovf2wo0qlxvkhoxnwxxyzgts\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Apache Hive\\u00a0Metastore (HMS) uses\\u00a0SerializationUtilities#deserializeObjectWithTypeInformation\\u00a0method when filtering and fetching partitions that is unsafe and\\u00a0can lead\\u00a0to Remote Code Execution (RCE) since it allows the deserialization of arbitrary data.\\n\\nIn real deployments, the vulnerability can be exploited only by authenticated users/clients that were able to successfully establish\\u00a0a connection to the Metastore. From an API perspective any code that calls the unsafe method may be vulnerable unless it performs additional prerechecks on the input arguments.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Apache Hive\u0026nbsp;Metastore (HMS) uses\u0026nbsp;\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eSerializationUtilities#deserializeObjectWithTypeInformation\u003c/span\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e\u0026nbsp;method when filtering and fetching partitions that is unsafe and\u003c/span\u003e\u0026nbsp;can lead\u0026nbsp;to Remote Code Execution (RCE) since it allows the deserialization of arbitrary data.\u003cbr\u003e\u003cbr\u003eIn real deployments, the vulnerability can be exploited only by authenticated users/clients that were able to successfully establish\u0026nbsp;a connection to the Metastore. From an API perspective any code that calls the unsafe method may be vulnerable unless it performs additional prerechecks on the input arguments.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-502\", \"description\": \"CWE-502 Deserialization of Untrusted Data\"}]}], \"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2024-12-05T10:01:41.692Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-41137\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-05T17:02:05.659Z\", \"dateReserved\": \"2022-09-20T14:55:51.817Z\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"datePublished\": \"2024-12-05T10:01:41.692Z\", \"assignerShortName\": \"apache\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.