Read the docs
TI-2016-02582 Aliases CVE-2016-3083GHSA-gf2v-9hp6-44qg

Improper certificate validation in Apache Hive

Priority LOW 35CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-295.

Summary

Apache Hive (JDBC + HiveServer2) implements SSL for plain TCP and HTTP connections (it supports both transport modes). While validating the server's certificate during the connection setup, the client in Apache Hive before 1.2.2 and 2.0.x before 2.0.1 doesn't seem to be verifying the common name attribute of the certificate. In this way, if a JDBC client sends an SSL request to server abc.com, and the server responds with a valid certificate (certified by CA) but issued to xyz.com, the client will accept that as a valid certificate and the SSL handshake will go through.

Why it matters now

EPSS 0.01006 63rd percentileScored 2026-11-07
Fix Fixed org.apache.hive:hive (Maven): 1.2.2, 2.0.1org.apache.hive:hive-service (Maven): 1.2.2, 2.0.1+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Hive0.11.0 - 0.14.0; 1.0.0 - 1.2.1; 2.0.0—No fix listedCNA
—org.apache.hive:hive (Maven)before 1.2.21.2.2Patch availableGHSA-gf2v-9hp6-44qg
—org.apache.hive:hive (Maven)2.0.0 to before 2.0.12.0.1Patch availableGHSA-gf2v-9hp6-44qg
—org.apache.hive:hive-service (Maven)before 1.2.21.2.2Patch availableGHSA-gf2v-9hp6-44qg
—org.apache.hive:hive-service (Maven)2.0.0 to before 2.0.12.0.1Patch availableGHSA-gf2v-9hp6-44qg
—org.apache.hive:hive-exec (Maven)before 1.2.21.2.2Patch availableGHSA-gf2v-9hp6-44qg
—org.apache.hive:hive-exec (Maven)2.0.0 to before 2.0.12.0.1Patch availableGHSA-gf2v-9hp6-44qg
  • Apache Hive VendorApache Affected 0.11.0 - 0.14.0; 1.0.0 - 1.2.1; 2.0.0 Fixed in — No fix listed CNA
  • org.apache.hive:hive (Maven) Vendor— Affected before 1.2.2 Fixed in 1.2.2 Patch available GHSA-gf2v-9hp6-44qg
  • org.apache.hive:hive (Maven) Vendor— Affected 2.0.0 to before 2.0.1 Fixed in 2.0.1 Patch available GHSA-gf2v-9hp6-44qg
  • org.apache.hive:hive-service (Maven) Vendor— Affected before 1.2.2 Fixed in 1.2.2 Patch available GHSA-gf2v-9hp6-44qg
  • org.apache.hive:hive-service (Maven) Vendor— Affected 2.0.0 to before 2.0.1 Fixed in 2.0.1 Patch available GHSA-gf2v-9hp6-44qg
  • org.apache.hive:hive-exec (Maven) Vendor— Affected before 1.2.2 Fixed in 1.2.2 Patch available GHSA-gf2v-9hp6-44qg
  • org.apache.hive:hive-exec (Maven) Vendor— Affected 2.0.0 to before 2.0.1 Fixed in 2.0.1 Patch available GHSA-gf2v-9hp6-44qg

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:apache:hive:0.13.0:*:*:*:*:*:*:*0.13.0VulnerableApache
cpe:2.3:a:apache:hive:0.13.1:*:*:*:*:*:*:*0.13.1VulnerableApache
cpe:2.3:a:apache:hive:0.14.0:*:*:*:*:*:*:*0.14.0VulnerableApache
cpe:2.3:a:apache:hive:1.0.0:*:*:*:*:*:*:*1.0.0VulnerableApache
cpe:2.3:a:apache:hive:1.0.1:*:*:*:*:*:*:*1.0.1VulnerableApache
cpe:2.3:a:apache:hive:1.1.0:*:*:*:*:*:*:*1.1.0VulnerableApache
cpe:2.3:a:apache:hive:1.1.1:*:*:*:*:*:*:*1.1.1VulnerableApache
cpe:2.3:a:apache:hive:1.2.0:*:*:*:*:*:*:*1.2.0VulnerableApache
cpe:2.3:a:apache:hive:1.2.1:*:*:*:*:*:*:*1.2.1VulnerableApache
  • cpe:2.3:a:apache:hive:0.13.0:*:*:*:*:*:*:* Versions 0.13.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:hive:0.13.1:*:*:*:*:*:*:* Versions 0.13.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:hive:0.14.0:*:*:*:*:*:*:* Versions 0.14.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:hive:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:hive:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:hive:1.1.0:*:*:*:*:*:*:* Versions 1.1.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:hive:1.1.1:*:*:*:*:*:*:* Versions 1.1.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:hive:1.2.0:*:*:*:*:*:*:* Versions 1.2.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:hive:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·Apache

Remediation

  • Fix · GHSA-gf2v-9hp6-44qg org.apache.hive:hive (Maven) Fixed in 1.2.2 Advisory →
  • Fix · GHSA-gf2v-9hp6-44qg org.apache.hive:hive (Maven) Fixed in 2.0.1 Advisory →
  • Fix · GHSA-gf2v-9hp6-44qg org.apache.hive:hive-service (Maven) Fixed in 1.2.2 Advisory →
  • Fix · GHSA-gf2v-9hp6-44qg org.apache.hive:hive-service (Maven) Fixed in 2.0.1 Advisory →
  • Fix · GHSA-gf2v-9hp6-44qg org.apache.hive:hive-exec (Maven) Fixed in 1.2.2 Advisory →
  • Fix · GHSA-gf2v-9hp6-44qg org.apache.hive:hive-exec (Maven) Fixed in 2.0.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-3083
  2. 2026-10-03 Alias added: GHSA-gf2v-9hp6-44qg

References

Advisory 2

Other 2

  • TI-2018-15196 Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set. CVSS 3.1CRITICAL 9.8
  • TI-2026-40376 Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url CVSS 3.1CRITICAL 9.1
  • TI-2018-01187 SQL injection in Apache Hive CVSS 3.0CRITICAL 9.1
  • TI-2026-36749 Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths CVSS 3.1CRITICAL 9.8
  • TI-2015-06259 The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1… CVSS 3.0HIGH 8.3
  • TI-2020-10925 Uncontrolled resource consumption in Apache Thrift CVSS 3.1HIGH 7.5
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences