https://bugzilla.redhat.com/show_bug.cgi?id=1303041
Bug ID: 1303041 Summary: CVE-2015-7521 Apache Hive: authorization vulnerability Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team@redhat.com Reporter: anemec@redhat.com CC: java-sig-commits@lists.fedoraproject.org, me@coolsvap.net, moceap@hotmail.com, pmackinn@redhat.com
The following flaw was reported in Apache Hive:
Some partition-level operations exist that do not explicitly also authorize privileges of the parent table. This can lead to issues when the parent table would have denied the operation, but no denial occurs because the partition-level privilege is not checked by the authorization framework, which defines authorization entities only from the table level upwards.
This issue is known to affect Hive clusters protected by both Ranger as well as SqlStdHiveAuthorization.
External reference:
http://seclists.org/bugtraq/2016/Jan/157
https://bugzilla.redhat.com/show_bug.cgi?id=1303041
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1303042
--- Comment #1 from Andrej Nemec anemec@redhat.com ---
Created hive tracking bugs for this issue:
Affects: fedora-all [bug 1303042]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1303042 [Bug 1303042] CVE-2015-7521 Apache Hive: authorization vulnerability [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1303041
--- Comment #2 from Andrej Nemec anemec@redhat.com --- Updated external reference:
http://seclists.org/oss-sec/2016/q1/368
https://bugzilla.redhat.com/show_bug.cgi?id=1303041 Bug 1303041 depends on bug 1303042, which changed state.
Bug 1303042 Summary: CVE-2015-7521 Apache Hive: authorization vulnerability [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1303042
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |EOL
java-sig-commits@lists.fedoraproject.org