GHSA-jf2m-435m-mxw8

Suggest an improvement
Source
https://github.com/advisories/GHSA-jf2m-435m-mxw8
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/11/GHSA-jf2m-435m-mxw8/GHSA-jf2m-435m-mxw8.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-jf2m-435m-mxw8
Aliases
Published
2018-11-21T22:24:34Z
Modified
2024-04-19T19:46:00.101716Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
SQL Injection in hive-jdbc
Details

This vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 allows carefully crafted arguments to be used to bypass the argument escaping/cleanup that JDBC driver does in PreparedStatement implementation.

Database specific 
{
    "nvd_published_at": null,
    "github_reviewed_at": "2020-06-16T21:43:10Z",
    "severity": "CRITICAL",
    "cwe_ids": [
        "CWE-89"
    ],
    "github_reviewed": true
}
References

Affected packages

Maven / org.apache.hive:hive-jdbc

Package

Name
org.apache.hive:hive-jdbc
View open source insights on deps.dev
Purl
pkg:maven/org.apache.hive/hive-jdbc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.7.1
Fixed
2.3.3

Affected versions

0.*
0.8.0
0.8.1
0.9.0
0.10.0
0.11.0
0.12.0
0.13.0
0.13.1
0.14.0
1.*
1.0.0
1.0.1
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
2.*
2.0.0
2.0.1
2.1.0
2.1.1
2.2.0
2.3.0
2.3.1
2.3.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/11/GHSA-jf2m-435m-mxw8/GHSA-jf2m-435m-mxw8.json"