fkie_cve-2022-41137
Vulnerability from fkie_nvd
Published
2024-12-05 10:15
Modified
2024-12-05 17:15
Severity ?
8.3 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Summary
Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe and can lead to Remote Code Execution (RCE) since it allows the deserialization of arbitrary data. In real deployments, the vulnerability can be exploited only by authenticated users/clients that were able to successfully establish a connection to the Metastore. From an API perspective any code that calls the unsafe method may be vulnerable unless it performs additional prerechecks on the input arguments.
References
security@apache.orghttps://github.com/apache/hive
security@apache.orghttps://github.com/apache/hive/commit/60027bb9c91a93affcfebd9068f064bc1f2a74c9
security@apache.orghttps://issues.apache.org/jira/browse/HIVE-26539
security@apache.orghttps://lists.apache.org/thread/jwtr3d9yovf2wo0qlxvkhoxnwxxyzgts
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2024/12/04/2
Impacted products
Vendor Product Version


To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Apache Hive\u00a0Metastore (HMS) uses\u00a0SerializationUtilities#deserializeObjectWithTypeInformation\u00a0method when filtering and fetching partitions that is unsafe and\u00a0can lead\u00a0to Remote Code Execution (RCE) since it allows the deserialization of arbitrary data.\n\nIn real deployments, the vulnerability can be exploited only by authenticated users/clients that were able to successfully establish\u00a0a connection to the Metastore. From an API perspective any code that calls the unsafe method may be vulnerable unless it performs additional prerechecks on the input arguments."
    },
    {
      "lang": "es",
      "value": "Apache Hive Metastore (HMS) utiliza el m\u00e9todo SerializationUtilities#deserializeObjectWithTypeInformation al filtrar y obtener particiones, lo que no es seguro y puede provocar una ejecuci\u00f3n de c\u00f3digo remoto (RCE), ya que permite la deserializaci\u00f3n de datos arbitrarios. En implementaciones reales, la vulnerabilidad solo puede ser explotada por usuarios o clientes autenticados que pudieron establecer una conexi\u00f3n exitosa con Metastore. Desde una perspectiva de API, cualquier c\u00f3digo que llame al m\u00e9todo no seguro puede ser vulnerable a menos que realice comprobaciones previas adicionales en los argumentos de entrada."
    }
  ],
  "id": "CVE-2022-41137",
  "lastModified": "2024-12-05T17:15:07.033",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.3,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.5,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-12-05T10:15:04.450",
  "references": [
    {
      "source": "security@apache.org",
      "url": "https://github.com/apache/hive"
    },
    {
      "source": "security@apache.org",
      "url": "https://github.com/apache/hive/commit/60027bb9c91a93affcfebd9068f064bc1f2a74c9"
    },
    {
      "source": "security@apache.org",
      "url": "https://issues.apache.org/jira/browse/HIVE-26539"
    },
    {
      "source": "security@apache.org",
      "url": "https://lists.apache.org/thread/jwtr3d9yovf2wo0qlxvkhoxnwxxyzgts"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2024/12/04/2"
    }
  ],
  "sourceIdentifier": "security@apache.org",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ],
      "source": "security@apache.org",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.