CVE-2018-1282: SQL Injection
This vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 allows carefully crafted arguments to be used to bypass the argument escaping/cleanup that JDBC driver does in PreparedStatement implementation.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-1282?
CVE-2018-1282 is a vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 that allows carefully crafted arguments to bypass argument escaping/cleanup.
What is the severity of CVE-2018-1282?
CVE-2018-1282 is a critical vulnerability with a severity score of 9.1.
How does CVE-2018-1282 affect Apache Hive?
CVE-2018-1282 affects Apache Hive versions 0.7.1 to 2.3.2.
How can CVE-2018-1282 be exploited?
CVE-2018-1282 can be exploited by using carefully crafted arguments to bypass the argument escaping/cleanup in the PreparedStatement implementation of the Apache Hive JDBC driver.
Are there any references available for CVE-2018-1282?
Yes, you can find more information about CVE-2018-1282 at the following references: [SecurityFocus](http://www.securityfocus.com/bid/103751), [IBM X-Force](https://exchange.xforce.ibmcloud.com/vulnerabilities/141253), [Apache Mailing List](https://lists.apache.org/thread.html/74bd2bff1827febb348dfb323986fa340d3bb97a315ab93c3ccc8299@%3Cdev.hive.apache.org%3E).