You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@hive.apache.org by Sai Hemanth Gantasala <gs...@apache.org> on 2026/08/24 19:27:45 UTC
[ANNOUNCE] Apache Hive 4.2.1 Released
The Apache Hive team is proud to announce the release of Apache Hive
version 4.2.1.
This bugfix release addresses three security vulnerabilities:
- HIVE-29622: Potential vulnerability in HiveMetaStore partition-name
direct-SQL paths
- HIVE-29653: Unauthenticated authentication bypass in HiveServer2 HTTP
SAML bearer-token validation
- HIVE-29671: SSRF in Avro SerDe via avro.schema.url
*Users running Apache Hive 4.2.0 are encouraged to upgrade to 4.2.1*.
The Apache Hive (TM) data warehouse software facilitates querying and
managing large datasets residing in distributed storage. Built on top
of Apache Hadoop (TM), it provides, among others:
- Tools to enable easy data extract/transform/load (ETL)
- A mechanism to impose structure on a variety of data formats
- Access to files stored either directly in Apache HDFS (TM) or in other
data storage systems such as Apache HBase (TM)
- Massively parallel query execution via Apache Tez
For Hive release details and downloads, please visit:
https://hive.apache.org/downloads.html
Hive 4.2.1 Release Notes are available here:
https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12310843&version=12357270
For the Docker image, check:
https://hub.docker.com/r/apache/hive/tags
We would like to thank the many contributors who made this release possible.
Regards,
The Apache Hive Team
Fwd: [ANNOUNCE] Apache Hive 4.2.1 Released
Posted by Sai Hemanth Gantasala <gs...@apache.org>.
---------- Forwarded message ---------
From: Sai Hemanth Gantasala <gs...@apache.org>
Date: Mon, Aug 24, 2026 at 12:27 PM
Subject: [ANNOUNCE] Apache Hive 4.2.1 Released
To: <us...@hive.apache.org>, dev <de...@hive.apache.org>, <an...@apache.org>
The Apache Hive team is proud to announce the release of Apache Hive
version 4.2.1.
This bugfix release addresses three security vulnerabilities:
HIVE-29622: Potential vulnerability in HiveMetaStore partition-name
direct-SQL paths
HIVE-29653: Unauthenticated authentication bypass in HiveServer2 HTTP
SAML bearer-token validation
HIVE-29671: SSRF in Avro SerDe via avro.schema.url
Users running Apache Hive 4.2.0 are encouraged to upgrade to 4.2.1.
The Apache Hive (TM) data warehouse software facilitates querying and
managing large datasets residing in distributed storage. Built on top
of Apache Hadoop (TM), it provides, among others:
Tools to enable easy data extract/transform/load (ETL)
A mechanism to impose structure on a variety of data formats
Access to files stored either directly in Apache HDFS (TM) or in other
data storage systems such as Apache HBase (TM)
Massively parallel query execution via Apache Tez
For Hive release details and downloads, please visit:
https://hive.apache.org/downloads.html
Hive 4.2.1 Release Notes are available here:
https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12310843&version=12357270
For the Docker image, check:
https://hub.docker.com/r/apache/hive/tags
We would like to thank the many contributors who made this release possible.
Regards,
The Apache Hive Team
Re: [ANNOUNCE] Apache Hive 4.2.1 Released
Posted by "Weber, Richard via dev" <de...@hive.apache.org>.
Done. Thanks
<https://issues.apache.org/jira/browse/HIVE-30010>
[HIVE-30010] All Hive Jar's were not published to public Maven repositories - ASF Jira<https://issues.apache.org/jira/browse/HIVE-30010>
issues.apache.org<https://issues.apache.org/jira/browse/HIVE-30010>
[jira-favicon-hires.png] <https://issues.apache.org/jira/browse/HIVE-30010>
On Sep 2, 2026, at 8:50 AM, Stamatis Zampetakis <za...@apache.org> wrote:
This Message Is From an External Sender
This message came from outside your organization.
Hi Rick,
Indeed there is a publishing problem of the jars in Maven. The druid and accumulo jars for 4.2.1 are not present in central [1] nor in the Apache maven repository [2]. I guess some step in the preparation of the release candidate was performed differently (possibly a profile skipping those modules) and we failed to catch it during the vote. Please log a JIRA ticket for tracking this further and we will see how we can rectify this.
Best,
Stamatis
PS. The Druid handler has been removed completely from the repo and will not be part of 4.3.0 release. However, this is not relevant for 4.2.1 so completely independent of the problem.
[1] https://central.sonatype.com/artifact/org.apache.hive/hive-druid-handler<https://urldefense.com/v3/__https://central.sonatype.com/artifact/org.apache.hive/hive-druid-handler__;!!GjvTz_vk!W1pQE4V5b8EIiLWpFdc8FbUpaG2VRzdsFDaGxsN6cHTqN_9EyAergSfgQpPABAzsUotajPikusCtTrc$>
[2] https://repository.apache.org/content/groups/public/org/apache/hive/hive-druid-handler/<https://urldefense.com/v3/__https://repository.apache.org/content/groups/public/org/apache/hive/hive-druid-handler/__;!!GjvTz_vk!W1pQE4V5b8EIiLWpFdc8FbUpaG2VRzdsFDaGxsN6cHTqN_9EyAergSfgQpPABAzsUotajPikfrYGKoE$>
On Wed, Sep 2, 2026 at 2:19 PM Weber, Richard via dev <de...@hive.apache.org>> wrote:
It looks like both the hive-druid-handler & hive-accumulo-handler jars are missing. I'm running into errors while building from source, where the Hive POM makes references to these JAR's, but they aren't currently being built by my project. (eg: ` !:hive-accumulo-handler !:hive-druid-handler ...`)
https://mvnrepository.com/artifact/org.apache.hive/hive-druid-handler<https://urldefense.com/v3/__https://mvnrepository.com/artifact/org.apache.hive/hive-druid-handler__;!!GjvTz_vk!W1pQE4V5b8EIiLWpFdc8FbUpaG2VRzdsFDaGxsN6cHTqN_9EyAergSfgQpPABAzsUotajPikyfnq31M$>
https://mvnrepository.com/artifact/org.apache.hive/hive-accumulo-handler<https://urldefense.com/v3/__https://mvnrepository.com/artifact/org.apache.hive/hive-accumulo-handler__;!!GjvTz_vk!W1pQE4V5b8EIiLWpFdc8FbUpaG2VRzdsFDaGxsN6cHTqN_9EyAergSfgQpPABAzsUotajPikSyZShyI$>
It _was_ building fine in Hive 4.2.0, so I'm guessing Maven was silently pulling those JAR's down to make the whole package.
Thanks
--Rick Weber
On Sep 2, 2026, at 5:55 AM, Stamatis Zampetakis <za...@apache.org>> wrote:
This Message Is From an External Sender
This message came from outside your organization.
Hi Rick,
The JARs should be available already. Can you please point out what is missing and from where?
Best,
Stamatis
On Tue, Sep 1, 2026 at 2:55 PM Weber, Richard via dev <de...@hive.apache.org>> wrote:
Hi all,
Minor question/note, it looks like the Hive 4.2.1 JAR's have not been published publicly yet? Is there an estimate for when that might occur?
Thanks
--Rick Weber
On Aug 26, 2026, at 3:40 AM, Stamatis Zampetakis <za...@apache.org>> wrote:
This Message Is From an External Sender
This message came from outside your organization.
A relatively small but very important release for making Hive robust and more secure!
Thanks a lot Sai for driving the release and taking care of all reported vulnerabilities.
Best,
Stamatis
On Tue, Aug 25, 2026 at 11:54 AM Shohei Okumiya <ok...@apache.org>> wrote:
Congratulations!
Thank you, Sai, for serving as the release manager.
Best,
Okumin
On Tue, Aug 25, 2026 at 5:20 PM Denys Kuzmenko <dk...@apache.org>> wrote:
>
> Congrats! 🎉
> Thank you, Sai, for driving the release! Next up: 4.3.0.
Re: [ANNOUNCE] Apache Hive 4.2.1 Released
Posted by Stamatis Zampetakis <za...@apache.org>.
Hi Rick,
Indeed there is a publishing problem of the jars in Maven. The druid and
accumulo jars for 4.2.1 are not present in central [1] nor in the Apache
maven repository [2]. I guess some step in the preparation of the release
candidate was performed differently (possibly a profile skipping those
modules) and we failed to catch it during the vote. Please log a JIRA
ticket for tracking this further and we will see how we can rectify this.
Best,
Stamatis
PS. The Druid handler has been removed completely from the repo and will
not be part of 4.3.0 release. However, this is not relevant for 4.2.1 so
completely independent of the problem.
[1] https://central.sonatype.com/artifact/org.apache.hive/hive-druid-handler
[2]
https://repository.apache.org/content/groups/public/org/apache/hive/hive-druid-handler/
On Wed, Sep 2, 2026 at 2:19 PM Weber, Richard via dev <de...@hive.apache.org>
wrote:
> It looks like both the hive-druid-handler & hive-accumulo-handler jars are
> missing. I'm running into errors while building from source, where the
> Hive POM makes references to these JAR's, but they aren't currently being
> built by my project. (eg: ` !:hive-accumulo-handler
> !:hive-druid-handler ...`)
>
>
> https://mvnrepository.com/artifact/org.apache.hive/hive-druid-handler
>
> https://mvnrepository.com/artifact/org.apache.hive/hive-accumulo-handler
>
>
> It _was_ building fine in Hive 4.2.0, so I'm guessing Maven was silently
> pulling those JAR's down to make the whole package.
>
> Thanks
>
> --Rick Weber
>
>
>
> On Sep 2, 2026, at 5:55 AM, Stamatis Zampetakis <za...@apache.org>
> wrote:
>
> This Message Is From an External Sender
> This message came from outside your organization.
> Hi Rick,
>
> The JARs should be available already. Can you please point out what is
> missing and from where?
>
> Best,
> Stamatis
>
> On Tue, Sep 1, 2026 at 2:55 PM Weber, Richard via dev <de...@hive.apache.org>
> wrote:
>
>> Hi all,
>>
>> Minor question/note, it looks like the Hive 4.2.1 JAR's have not been
>> published publicly yet? Is there an estimate for when that might occur?
>>
>> Thanks
>>
>> --Rick Weber
>>
>> On Aug 26, 2026, at 3:40 AM, Stamatis Zampetakis <za...@apache.org>
>> wrote:
>>
>> This Message Is From an External Sender
>> This message came from outside your organization.
>> A relatively small but very important release for making Hive robust and
>> more secure!
>>
>> Thanks a lot Sai for driving the release and taking care of all reported
>> vulnerabilities.
>>
>> Best,
>> Stamatis
>>
>> On Tue, Aug 25, 2026 at 11:54 AM Shohei Okumiya <ok...@apache.org>
>> wrote:
>>
>>> Congratulations!
>>> Thank you, Sai, for serving as the release manager.
>>>
>>> Best,
>>> Okumin
>>>
>>> On Tue, Aug 25, 2026 at 5:20 PM Denys Kuzmenko <dk...@apache.org>
>>> wrote:
>>> >
>>> > Congrats! 🎉
>>> > Thank you, Sai, for driving the release! Next up: 4.3.0.
>>
>>
>
Re: [ANNOUNCE] Apache Hive 4.2.1 Released
Posted by "Weber, Richard via dev" <de...@hive.apache.org>.
It looks like both the hive-druid-handler & hive-accumulo-handler jars are missing. I'm running into errors while building from source, where the Hive POM makes references to these JAR's, but they aren't currently being built by my project. (eg: ` !:hive-accumulo-handler !:hive-druid-handler ...`)
https://mvnrepository.com/artifact/org.apache.hive/hive-druid-handler
https://mvnrepository.com/artifact/org.apache.hive/hive-accumulo-handler
It _was_ building fine in Hive 4.2.0, so I'm guessing Maven was silently pulling those JAR's down to make the whole package.
Thanks
--Rick Weber
On Sep 2, 2026, at 5:55 AM, Stamatis Zampetakis <za...@apache.org> wrote:
This Message Is From an External Sender
This message came from outside your organization.
Hi Rick,
The JARs should be available already. Can you please point out what is missing and from where?
Best,
Stamatis
On Tue, Sep 1, 2026 at 2:55 PM Weber, Richard via dev <de...@hive.apache.org>> wrote:
Hi all,
Minor question/note, it looks like the Hive 4.2.1 JAR's have not been published publicly yet? Is there an estimate for when that might occur?
Thanks
--Rick Weber
On Aug 26, 2026, at 3:40 AM, Stamatis Zampetakis <za...@apache.org>> wrote:
This Message Is From an External Sender
This message came from outside your organization.
A relatively small but very important release for making Hive robust and more secure!
Thanks a lot Sai for driving the release and taking care of all reported vulnerabilities.
Best,
Stamatis
On Tue, Aug 25, 2026 at 11:54 AM Shohei Okumiya <ok...@apache.org>> wrote:
Congratulations!
Thank you, Sai, for serving as the release manager.
Best,
Okumin
On Tue, Aug 25, 2026 at 5:20 PM Denys Kuzmenko <dk...@apache.org>> wrote:
>
> Congrats! 🎉
> Thank you, Sai, for driving the release! Next up: 4.3.0.
Re: [ANNOUNCE] Apache Hive 4.2.1 Released
Posted by Stamatis Zampetakis <za...@apache.org>.
Hi Rick,
The JARs should be available already. Can you please point out what is
missing and from where?
Best,
Stamatis
On Tue, Sep 1, 2026 at 2:55 PM Weber, Richard via dev <de...@hive.apache.org>
wrote:
> Hi all,
>
> Minor question/note, it looks like the Hive 4.2.1 JAR's have not been
> published publicly yet? Is there an estimate for when that might occur?
>
> Thanks
>
> --Rick Weber
>
> On Aug 26, 2026, at 3:40 AM, Stamatis Zampetakis <za...@apache.org>
> wrote:
>
> This Message Is From an External Sender
> This message came from outside your organization.
> A relatively small but very important release for making Hive robust and
> more secure!
>
> Thanks a lot Sai for driving the release and taking care of all reported
> vulnerabilities.
>
> Best,
> Stamatis
>
> On Tue, Aug 25, 2026 at 11:54 AM Shohei Okumiya <ok...@apache.org> wrote:
>
>> Congratulations!
>> Thank you, Sai, for serving as the release manager.
>>
>> Best,
>> Okumin
>>
>> On Tue, Aug 25, 2026 at 5:20 PM Denys Kuzmenko <dk...@apache.org>
>> wrote:
>> >
>> > Congrats! 🎉
>> > Thank you, Sai, for driving the release! Next up: 4.3.0.
>
>
>
Re: [ANNOUNCE] Apache Hive 4.2.1 Released
Posted by "Weber, Richard via dev" <de...@hive.apache.org>.
Hi all,
Minor question/note, it looks like the Hive 4.2.1 JAR's have not been published publicly yet? Is there an estimate for when that might occur?
Thanks
--Rick Weber
On Aug 26, 2026, at 3:40 AM, Stamatis Zampetakis <za...@apache.org> wrote:
This Message Is From an External Sender
This message came from outside your organization.
A relatively small but very important release for making Hive robust and more secure!
Thanks a lot Sai for driving the release and taking care of all reported vulnerabilities.
Best,
Stamatis
On Tue, Aug 25, 2026 at 11:54 AM Shohei Okumiya <ok...@apache.org>> wrote:
Congratulations!
Thank you, Sai, for serving as the release manager.
Best,
Okumin
On Tue, Aug 25, 2026 at 5:20 PM Denys Kuzmenko <dk...@apache.org>> wrote:
>
> Congrats! 🎉
> Thank you, Sai, for driving the release! Next up: 4.3.0.
Re: [ANNOUNCE] Apache Hive 4.2.1 Released
Posted by Stamatis Zampetakis <za...@apache.org>.
A relatively small but very important release for making Hive robust and
more secure!
Thanks a lot Sai for driving the release and taking care of all reported
vulnerabilities.
Best,
Stamatis
On Tue, Aug 25, 2026 at 11:54 AM Shohei Okumiya <ok...@apache.org> wrote:
> Congratulations!
> Thank you, Sai, for serving as the release manager.
>
> Best,
> Okumin
>
> On Tue, Aug 25, 2026 at 5:20 PM Denys Kuzmenko <dk...@apache.org>
> wrote:
> >
> > Congrats! 🎉
> > Thank you, Sai, for driving the release! Next up: 4.3.0.
>
Re: [ANNOUNCE] Apache Hive 4.2.1 Released
Posted by Shohei Okumiya <ok...@apache.org>.
Congratulations!
Thank you, Sai, for serving as the release manager.
Best,
Okumin
On Tue, Aug 25, 2026 at 5:20 PM Denys Kuzmenko <dk...@apache.org> wrote:
>
> Congrats! 🎉
> Thank you, Sai, for driving the release! Next up: 4.3.0.
Re: [ANNOUNCE] Apache Hive 4.2.1 Released
Posted by Denys Kuzmenko <dk...@apache.org>.
Congrats! 🎉
Thank you, Sai, for driving the release! Next up: 4.3.0.
Re: [ANNOUNCE] Apache Hive 4.2.1 Released
Posted by Zhihua Deng <de...@apache.org>.
Congratulations! Thank you Sai for driving the release.
On 2026/08/24 19:27:45 Sai Hemanth Gantasala wrote:
> The Apache Hive team is proud to announce the release of Apache Hive
> version 4.2.1.
>
> This bugfix release addresses three security vulnerabilities:
>
> - HIVE-29622: Potential vulnerability in HiveMetaStore partition-name
> direct-SQL paths
> - HIVE-29653: Unauthenticated authentication bypass in HiveServer2 HTTP
> SAML bearer-token validation
> - HIVE-29671: SSRF in Avro SerDe via avro.schema.url
>
> *Users running Apache Hive 4.2.0 are encouraged to upgrade to 4.2.1*.
>
> The Apache Hive (TM) data warehouse software facilitates querying and
> managing large datasets residing in distributed storage. Built on top
> of Apache Hadoop (TM), it provides, among others:
>
> - Tools to enable easy data extract/transform/load (ETL)
> - A mechanism to impose structure on a variety of data formats
> - Access to files stored either directly in Apache HDFS (TM) or in other
> data storage systems such as Apache HBase (TM)
> - Massively parallel query execution via Apache Tez
>
> For Hive release details and downloads, please visit:
> https://hive.apache.org/downloads.html
>
> Hive 4.2.1 Release Notes are available here:
> https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12310843&version=12357270
>
> For the Docker image, check:
> https://hub.docker.com/r/apache/hive/tags
>
> We would like to thank the many contributors who made this release possible.
>
> Regards,
> The Apache Hive Team
>