Bug 2330533 (CVE-2022-41137)

Summary: CVE-2022-41137 hive-metastore: org.apache.hive:hive-metastore: Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: chazlett, cmiranda, dfreiber, drow, gmalinko, janstey, jburrell, pcongius, pdelbell, pjindal, rstepani, vkumar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Apache Hive Metastore (HMS). This vulnerability allows remote code execution (RCE) via deserialization of arbitrary data when the `SerializationUtilities#deserializeObjectWithTypeInformation` method filters and fetches partitions without additional input validation. In real deployments, the vulnerability can be exploited only by authenticated users/clients who successfully establish a connection to the Metastore. From an API perspective, any code that calls the unsafe method may be vulnerable unless it performs additional rechecks on the input arguments.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2024-12-05 11:01:05 UTC 
Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe and can lead to Remote Code Execution (RCE) since it allows the deserialization of arbitrary data.

In real deployments, the vulnerability can be exploited only by authenticated users/clients that were able to successfully establish a connection to the Metastore. From an API perspective any code that calls the unsafe method may be vulnerable unless it performs additional prerechecks on the input arguments.