Apache Hive Vulnerable to Code Injection Attacks

CVE-2023-35701

What is CVE-2023-35701?

An issue within the Apache Hive JDBC driver introduces a vulnerability that can lead to arbitrary code execution on the host machine running the driver. This vulnerability occurs when a malicious user, having the necessary permissions, crafts a malicious JDBC URL that points to a compromised HTTP server. Upon attempting to establish a JDBC connection, the server responds with a specially crafted payload capable of executing arbitrary commands within the client process, particularly if it operates with elevated privileges. The vulnerability affects versions prior to 4.0.0 of Apache Hive. Immediate upgrade to the patched version is strongly advised to mitigate potential threats.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References