CVE-2022-41137
Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe and can lead to Remote Code Execution (RCE) since it allows the deserialization of arbitrary data.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.65%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe and can lead to Remote Code Execution (RCE) since it allows the deserialization of arbitrary data. In real deployments, the vulnerability can be exploited only by authenticated users/clients that were able to successfully establish a connection to the Metastore. From an API perspective any code that calls the unsafe method may be vulnerable unless it performs additional prerechecks on the input arguments.
- CVSS 3.1
- 8.3 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
- EPSS
- 1.65% probability · 75th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-502
- Affected
- apache/hive
- Source
- security@apache.org
References
- https://github.com/apache/hiveProduct
- https://github.com/apache/hive/commit/60027bb9c91a93affcfebd9068f064bc1f2a74c9Patch
- https://issues.apache.org/jira/browse/HIVE-26539Issue Tracking
- https://lists.apache.org/thread/jwtr3d9yovf2wo0qlxvkhoxnwxxyzgtsMailing List, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2024/12/04/2Mailing List, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.