Unsecure Method in Apache Hive Metastore Leads to Remote Code Execution Vulnerability

CVE-2022-41137

Summary

The Apache Hive Metastore is affected by a vulnerability that stems from its use of the unsafe method SerializationUtilities#deserializeObjectWithTypeInformation when filtering and fetching partitions. This flaw permits the deserialization of arbitrary data, which can potentially lead to Remote Code Execution (RCE). Exploitation of this vulnerability requires that the attacker is an authenticated user or client who has established a connection to the Metastore. Moreover, any code that interacts with this unsafe method may be susceptible unless it incorporates stringent prechecks on input parameters.

References