HI
Product
Hive
23
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 8Medium 8Low 2
Watch
Add Hive to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-35701 | 6.6 | May 3 | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Hive Affected: 4.0.0; 4.0.0; 4.0.0 |
| CVE-2024-23953 | 6.5 | Jan 28 | Use of Arrays.equals() in LlapSignerImpl in Apache Hive to compare message signatures allows attacker to forge a valid signature for an arbitrary message byte by byte Affected: 2.2.0 before 4.0.0 |
| CVE-2024-23945 | 5.9 | Dec 23 | Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification fails Affected: 1.2.0 before 4.0.0 |
| CVE-2020-1926 | 5.9 | Mar 16 | Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks Affected: before 2.3.8 |
| CVE-2024-29869 | 5.5 | Jan 28 | Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly Affected: 1.1.0 before 4.0.1 |
| CVE-2025-62728 | 5.4 | Nov 26 | SQL injection vulnerability in Hive Metastore Server (HMS) when processing delete column statistics requests via the Thrift APIs Affected: 4.1.0 |
| CVE-2018-1314 | 4.3 | Nov 8 | In Apache Hive 2.3.3, 3.1.0 and earlier, Hive "EXPLAIN" operation does not check for necessary authorization of involved entities in a query Affected: through 2.3.3; 3.0.0 through 3.1.0 |
| CVE-2017-12625 | 4.3 | Nov 1 | Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be defined on tables or views, e.g., using Apache… Affected: 2.1.0; 2.1.1; 2.2.0; 2.3.0 |
Showing 8