Read the docs
TI-2017-09350 Aliases CVE-2017-12625GHSA-2g9q-chq2-w8qw

Information disclosure in Apache Hive

Priority LOW 23CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be defined on tables or views, e.g., using Apache Ranger. When a view is created over a given table, the policy enforcement does not happen correctly on the table for masked columns.

Why it matters now

EPSS 0.01431 73rd percentileScored 2026-11-07
Fix Fixed Apache Hive (Apache Software Foundation): 2.1.2, 2.2.1org.apache.hive:hive (Maven): 2.1.2, 2.2.1, 2.3.1+2 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Hive2.1 to before 2.1.2; 2.2 to before 2.2.1; 2.3.02.1.2, 2.2.1Patch availableCNA
—org.apache.hive:hive (Maven)2.1.0 to before 2.1.22.1.2Patch availableGHSA-2g9q-chq2-w8qw
—org.apache.hive:hive (Maven)2.2.0 to before 2.2.12.2.1Patch availableGHSA-2g9q-chq2-w8qw
—org.apache.hive:hive (Maven)2.3.0 to before 2.3.12.3.1Patch availableGHSA-2g9q-chq2-w8qw
—org.apache.hive:hive-exec (Maven)2.1.0 to before 2.1.22.1.2Patch availableGHSA-2g9q-chq2-w8qw
—org.apache.hive:hive-exec (Maven)2.2.0 to before 2.2.12.2.1Patch availableGHSA-2g9q-chq2-w8qw
—org.apache.hive:hive-exec (Maven)2.3.0 to before 2.3.12.3.1Patch availableGHSA-2g9q-chq2-w8qw
—org.apache.hive:hive-service (Maven)2.1.0 to before 2.1.22.1.2Patch availableGHSA-2g9q-chq2-w8qw
—org.apache.hive:hive-service (Maven)2.2.0 to before 2.2.12.2.1Patch availableGHSA-2g9q-chq2-w8qw
—org.apache.hive:hive-service (Maven)2.3.0 to before 2.3.12.3.1Patch availableGHSA-2g9q-chq2-w8qw
  • Apache Hive VendorApache Affected 2.1 to before 2.1.2; 2.2 to before 2.2.1; 2.3.0 Fixed in 2.1.2, 2.2.1 Patch available CNA
  • org.apache.hive:hive (Maven) Vendor— Affected 2.1.0 to before 2.1.2 Fixed in 2.1.2 Patch available GHSA-2g9q-chq2-w8qw
  • org.apache.hive:hive (Maven) Vendor— Affected 2.2.0 to before 2.2.1 Fixed in 2.2.1 Patch available GHSA-2g9q-chq2-w8qw
  • org.apache.hive:hive (Maven) Vendor— Affected 2.3.0 to before 2.3.1 Fixed in 2.3.1 Patch available GHSA-2g9q-chq2-w8qw
  • org.apache.hive:hive-exec (Maven) Vendor— Affected 2.1.0 to before 2.1.2 Fixed in 2.1.2 Patch available GHSA-2g9q-chq2-w8qw
  • org.apache.hive:hive-exec (Maven) Vendor— Affected 2.2.0 to before 2.2.1 Fixed in 2.2.1 Patch available GHSA-2g9q-chq2-w8qw
  • org.apache.hive:hive-exec (Maven) Vendor— Affected 2.3.0 to before 2.3.1 Fixed in 2.3.1 Patch available GHSA-2g9q-chq2-w8qw
  • org.apache.hive:hive-service (Maven) Vendor— Affected 2.1.0 to before 2.1.2 Fixed in 2.1.2 Patch available GHSA-2g9q-chq2-w8qw
  • org.apache.hive:hive-service (Maven) Vendor— Affected 2.2.0 to before 2.2.1 Fixed in 2.2.1 Patch available GHSA-2g9q-chq2-w8qw
  • org.apache.hive:hive-service (Maven) Vendor— Affected 2.3.0 to before 2.3.1 Fixed in 2.3.1 Patch available GHSA-2g9q-chq2-w8qw

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:apache:hive:2.1.0:*:*:*:*:*:*:*2.1.0VulnerableApache
cpe:2.3:a:apache:hive:2.1.1:*:*:*:*:*:*:*2.1.1VulnerableApache
cpe:2.3:a:apache:hive:2.2.0:*:*:*:*:*:*:*2.2.0VulnerableApache
cpe:2.3:a:apache:hive:2.3.0:*:*:*:*:*:*:*2.3.0VulnerableApache
  • cpe:2.3:a:apache:hive:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:hive:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:hive:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:hive:2.3.0:*:*:*:*:*:*:* Versions 2.3.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Hive (Apache Software Foundation) Fixed in 2.1.2, 2.2.1
  • Fix · GHSA-2g9q-chq2-w8qw org.apache.hive:hive (Maven) Fixed in 2.1.2 Advisory →
  • Fix · GHSA-2g9q-chq2-w8qw org.apache.hive:hive (Maven) Fixed in 2.2.1 Advisory →
  • Fix · GHSA-2g9q-chq2-w8qw org.apache.hive:hive (Maven) Fixed in 2.3.1 Advisory →
  • Fix · GHSA-2g9q-chq2-w8qw org.apache.hive:hive-exec (Maven) Fixed in 2.1.2 Advisory →
  • Fix · GHSA-2g9q-chq2-w8qw org.apache.hive:hive-exec (Maven) Fixed in 2.2.1 Advisory →
  • Fix · GHSA-2g9q-chq2-w8qw org.apache.hive:hive-exec (Maven) Fixed in 2.3.1 Advisory →
  • Fix · GHSA-2g9q-chq2-w8qw org.apache.hive:hive-service (Maven) Fixed in 2.1.2 Advisory →
  • Fix · GHSA-2g9q-chq2-w8qw org.apache.hive:hive-service (Maven) Fixed in 2.2.1 Advisory →
  • Fix · GHSA-2g9q-chq2-w8qw org.apache.hive:hive-service (Maven) Fixed in 2.3.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-12625
  2. 2026-10-03 Alias added: GHSA-2g9q-chq2-w8qw

References

Advisory 3

  • TI-2018-15196 Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set. CVSS 3.1CRITICAL 9.8
  • TI-2026-40376 Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url CVSS 3.1CRITICAL 9.1
  • TI-2018-01187 SQL injection in Apache Hive CVSS 3.0CRITICAL 9.1
  • TI-2026-36749 Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths CVSS 3.1CRITICAL 9.8
  • TI-2015-06259 The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1… CVSS 3.0HIGH 8.3
  • TI-2020-10925 Uncontrolled resource consumption in Apache Thrift CVSS 3.1HIGH 7.5
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences