Read the docs
TI-2018-08434 Aliases CVE-2018-11777GHSA-rrfq-g5fq-fc9c

In Apache Hive 2.3.3, 3.1.0 and earlier, local resources on HiveServer2 machines are not…

Priority MEDIUM 40Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.

Summary

In Apache Hive 2.3.3, 3.1.0 and earlier, local resources on HiveServer2 machines are not properly protected against malicious user if ranger, sentry or sql standard authorizer is not in use.

Why it matters now

EPSS 0.02303 83rd percentileScored 2026-11-07
Fix Fixed org.apache.hive:hive-exec (Maven): 3.1.1, 2.3.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache HiveAll versions of Hive, including 2.3.3, 3.1.0 and earlier—No fix listedCNA
—org.apache.hive:hive-exec (Maven)3.0.0 to before 3.1.13.1.1Patch availableGHSA-rrfq-g5fq-fc9c
—org.apache.hive:hive-exec (Maven)before 2.3.42.3.4Patch availableGHSA-rrfq-g5fq-fc9c
  • Apache Hive VendorApache Affected All versions of Hive, including 2.3.3, 3.1.0 and earlier Fixed in — No fix listed CNA
  • org.apache.hive:hive-exec (Maven) Vendor— Affected 3.0.0 to before 3.1.1 Fixed in 3.1.1 Patch available GHSA-rrfq-g5fq-fc9c
  • org.apache.hive:hive-exec (Maven) Vendor— Affected before 2.3.4 Fixed in 2.3.4 Patch available GHSA-rrfq-g5fq-fc9c

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:hive:*:*:*:*:*:*:*:*up to 2.3.3; 3.0.0 – 3.1.0VulnerableApache
  • cpe:2.3:a:apache:hive:*:*:*:*:*:*:*:* Versions up to 2.3.3; 3.0.0 – 3.1.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-rrfq-g5fq-fc9c org.apache.hive:hive-exec (Maven) Fixed in 3.1.1 Advisory →
  • Fix · GHSA-rrfq-g5fq-fc9c org.apache.hive:hive-exec (Maven) Fixed in 2.3.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-11777
  2. 2026-10-03 Alias added: GHSA-rrfq-g5fq-fc9c

References

Advisory 2

Other 2

  • TI-2018-15196 Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set. CVSS 3.1CRITICAL 9.8
  • TI-2026-40376 Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url CVSS 3.1CRITICAL 9.1
  • TI-2018-01187 SQL injection in Apache Hive CVSS 3.0CRITICAL 9.1
  • TI-2026-36749 Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths CVSS 3.1CRITICAL 9.8
  • TI-2015-06259 The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1… CVSS 3.0HIGH 8.3
  • TI-2020-10925 Uncontrolled resource consumption in Apache Thrift CVSS 3.1HIGH 7.5
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences