CVE-2016-3083GHSA-GF2V-9HP6-44QG
Apache Hive (JDBC + HiveServer2) implements SSL for plain TCP and HTTP connections (it supports both transport modes).
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.2.2, 2.0.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Apache Hive (JDBC + HiveServer2) implements SSL for plain TCP and HTTP connections (it supports both transport modes). While validating the server's certificate during the connection setup, the client in Apache Hive before 1.2.2 and 2.0.x before 2.0.1 doesn't seem to be verifying the common name attribute of the certificate. In this way, if a JDBC client sends an SSL request to server abc.com, and the server responds with a valid certificate (certified by CA) but issued to xyz.com, the client will accept that as a valid certificate and the SSL handshake will go through.
Timeline
- CVE published
- Record last updated
Affected versions
- Apache Software Foundation Apache Hive
0.11.0 - 0.14.0, 1.0.0 - 1.2.1, 2.0.0
- org.apache.hive:hiveMaven
fixed in 1.2.2
- org.apache.hive:hiveMaven
From 2.0.0 · fixed in 2.0.1
- org.apache.hive:hive-serviceMaven
fixed in 1.2.2
- org.apache.hive:hive-serviceMaven
From 2.0.0 · fixed in 2.0.1
- org.apache.hive:hive-execMaven
fixed in 1.2.2
- org.apache.hive:hive-execMaven
From 2.0.0 · fixed in 2.0.1