CVE-2022-41137: Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore
Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe and can lead to Remote Code Execution (RCE) since it allows the deserialization of arbitrary data.
In real deployments, the vulnerability can be exploited only by authenticated users/clients that were able to successfully establish a connection to the Metastore. From an API perspective any code that calls the unsafe method may be vulnerable unless it performs additional prerechecks on the input arguments.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.hive:hive-execto a version that resolves this vulnerability.Fixed in 4.0.0-alpha-2
Event History
Frequently Asked Questions
What is the severity of CVE-2022-41137?
CVE-2022-41137 has a high severity rating due to its potential for Remote Code Execution (RCE) vulnerabilities.
How do I fix CVE-2022-41137?
To mitigate CVE-2022-41137, upgrade to Apache Hive version 4.0.0-alpha-2 or later, which addresses the deserialization issue.
What software is affected by CVE-2022-41137?
CVE-2022-41137 affects Apache Hive versions 4.0.0-alpha-1 and prior.
What kind of attack can be executed due to CVE-2022-41137?
CVE-2022-41137 can lead to Remote Code Execution (RCE), allowing attackers to execute arbitrary code on the vulnerable system.
Is there a workaround for CVE-2022-41137?
There are no official workarounds recommended for CVE-2022-41137; updating to a fixed version is the best course of action.