Apache Hive CVE-2016-3083 Security Bypass Vulnerability

Bugtraq ID:	98669
Class:	Design Error
CVE:	CVE-2016-3083
Remote:	Yes
Local:	No
Published:	May 24 2017 12:00AM
Updated:	May 24 2017 12:00AM
Credit:	Branden Crawford from Inteco Systems Limited.
Vulnerable:	Apache Hive 2.0 Apache Hive 1.2.1 Apache Hive 1.2 Apache Hive 1.1.1 Apache Hive 1.1 Apache Hive 1.0.1 Apache Hive 1.0 Apache Hive 0.14 Apache Hive 0.13.1 Apache Hive 0.13.0
Not Vulnerable:	Apache Hive 2.1 Apache Hive 2.0.1 Apache Hive 1.2.2

Apache Hive CVE-2016-3083 Security Bypass Vulnerability

Apache Hive is prone to a security-bypass vulnerability.

Successful exploits may allow an attacker to bypass certain security restrictions and to perform unauthorized actions; this may aid in launching further attacks.

The following versions are affected:

Apache Hive 0.13.x
Apache Hive 0.14.x
Apache Hive 1.0.0 through 1.0.1
Apache Hive 1.1.0 through 1.1.1
Apache Hive 1.2.0 through 1.2.1
Apache Hive 2.0.0

Apache Hive CVE-2016-3083 Security Bypass Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apache Hive CVE-2016-3083 Security Bypass Vulnerability

References:

• Apache Hive Homepage (The Apache Software Foundation)
  
• CVE-2016-3083: Apache Hive SSL vulnerability bug disclosure (Seclists)