Apache Ranger Hive Plugin missing permissions check
High severity
GitHub Reviewed
Published
May 5, 2023
to the GitHub Advisory Database
•
Updated Nov 10, 2023
Package
Affected versions
>= 2.0.0, < 2.4.0
Patched versions
2.4.0
Description
Published by the National Vulnerability Database
May 5, 2023
Published to the GitHub Advisory Database
May 5, 2023
Reviewed
May 5, 2023
Last updated
Nov 10, 2023
An Incorrect Permission Assignment for Critical Resource vulnerability was found in the Apache Ranger Hive Plugin. Any user with SELECT privilege on a database can alter the ownership of the table in Hive when Apache Ranger Hive Plugin is enabled
This issue affects Apache Ranger Hive Plugin: from 2.0.0 through 2.3.0. Users are recommended to upgrade to version 2.4.0 or later.
References