GHSA-c476-j253-5rgq

Suggest an improvement
Source
https://github.com/advisories/GHSA-c476-j253-5rgq
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-c476-j253-5rgq/GHSA-c476-j253-5rgq.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-c476-j253-5rgq
Aliases
Published
2025-01-29T00:31:54Z
Modified
2025-01-29T19:27:06.022164Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Apache Hive Incorrectly Assigns Permissions for a Critical Resource
Details

Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly. Any unauthorized user having access to the directory can read the sensitive information written into this file. Users are recommended to upgrade to version 4.0.1, which fixes this issue.

Database specific 
{
    "nvd_published_at": "2025-01-28T22:15:15Z",
    "cwe_ids": [
        "CWE-732"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2025-01-29T19:20:08Z"
}
References

Affected packages

Maven / org.apache.hive:hive-exec

Package

Name
org.apache.hive:hive-exec
View open source insights on deps.dev
Purl
pkg:maven/org.apache.hive/hive-exec

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.0.1

Affected versions

0.*

0.8.0
0.8.1
0.9.0
0.10.0
0.11.0
0.12.0
0.13.0
0.13.1
0.14.0

1.*

1.0.0
1.0.1
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2

2.*

2.0.0
2.0.1
2.1.0
2.1.1
2.2.0
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.3.6
2.3.7
2.3.8
2.3.9
2.3.10

3.*

3.0.0
3.1.0
3.1.1
3.1.2
3.1.3

4.*

4.0.0-alpha-1
4.0.0-alpha-2
4.0.0-beta-1
4.0.0