You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@sentry.apache.org by Sravya Tirukkovalur <sr...@apache.org> on 2016/08/04 23:27:12 UTC
CVE-2016-0760: Hive builtin functions “reflect”, “reflect2”, and “java_method” are not blocked in Apache Sentry
CVE-2016-0760: Hive builtin functions “reflect”, “reflect2”, and
“java_method” are not blocked in Apache Sentry
Severity: Very Important
Vendor:
The Apache Software Foundation
Versions Affected:
Sentry 1.5.1 and 1.6.0
Description:
Some functions in Hive which allow arbitrary code to be executed are
not blacklisted properly in some versions of Sentry, which would allow
authenticated
users to potentially use these functions for malicious purposes.
Mitigation:
Upgrade to 1.7.0 (or)
Workaround - Users can explicitly configure the blacklist
functions in the hive configuration by setting the property
"hive.server2.builtin.udf.blacklist" to "reflect,reflect2,java_method"
Credit:
This issue was discovered by Ryan Pridgeon of Cloudera.