{"id":"GHSA-2g9q-chq2-w8qw","summary":"Moderate severity vulnerability that affects org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service","details":"Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be defined on tables or views, e.g., using Apache Ranger. When a view is created over a given table, the policy enforcement does not happen correctly on the table for masked columns.","aliases":["CVE-2017-12625"],"modified":"2023-11-08T03:58:53.610587Z","published":"2019-03-14T15:40:16Z","database_specific":{"cwe_ids":["CWE-200"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2020-06-16T20:51:58Z","nvd_published_at":null},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12625"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-2g9q-chq2-w8qw"},{"type":"WEB","url":"http://mail-archives.apache.org/mod_mbox/hive-user/201710.mbox/%3C3791103E-80D5-4E75-AF23-6F8ED54DDEBE%40apache.org%3E"},{"type":"WEB","url":"http://www.securityfocus.com/bid/101686"}],"affected":[{"package":{"name":"org.apache.hive:hive","ecosystem":"Maven","purl":"pkg:maven/org.apache.hive/hive"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.2"}]}],"versions":["2.1.0","2.1.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/03/GHSA-2g9q-chq2-w8qw/GHSA-2g9q-chq2-w8qw.json"}},{"package":{"name":"org.apache.hive:hive","ecosystem":"Maven","purl":"pkg:maven/org.apache.hive/hive"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.1"}]}],"versions":["2.2.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/03/GHSA-2g9q-chq2-w8qw/GHSA-2g9q-chq2-w8qw.json"}},{"package":{"name":"org.apache.hive:hive","ecosystem":"Maven","purl":"pkg:maven/org.apache.hive/hive"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.1"}]}],"versions":["2.3.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/03/GHSA-2g9q-chq2-w8qw/GHSA-2g9q-chq2-w8qw.json"}},{"package":{"name":"org.apache.hive:hive-exec","ecosystem":"Maven","purl":"pkg:maven/org.apache.hive/hive-exec"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.2"}]}],"versions":["2.1.0","2.1.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/03/GHSA-2g9q-chq2-w8qw/GHSA-2g9q-chq2-w8qw.json"}},{"package":{"name":"org.apache.hive:hive-exec","ecosystem":"Maven","purl":"pkg:maven/org.apache.hive/hive-exec"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.1"}]}],"versions":["2.2.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/03/GHSA-2g9q-chq2-w8qw/GHSA-2g9q-chq2-w8qw.json"}},{"package":{"name":"org.apache.hive:hive-exec","ecosystem":"Maven","purl":"pkg:maven/org.apache.hive/hive-exec"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.1"}]}],"versions":["2.3.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/03/GHSA-2g9q-chq2-w8qw/GHSA-2g9q-chq2-w8qw.json"}},{"package":{"name":"org.apache.hive:hive-service","ecosystem":"Maven","purl":"pkg:maven/org.apache.hive/hive-service"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.2"}]}],"versions":["2.1.0","2.1.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/03/GHSA-2g9q-chq2-w8qw/GHSA-2g9q-chq2-w8qw.json"}},{"package":{"name":"org.apache.hive:hive-service","ecosystem":"Maven","purl":"pkg:maven/org.apache.hive/hive-service"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.1"}]}],"versions":["2.2.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/03/GHSA-2g9q-chq2-w8qw/GHSA-2g9q-chq2-w8qw.json"}},{"package":{"name":"org.apache.hive:hive-service","ecosystem":"Maven","purl":"pkg:maven/org.apache.hive/hive-service"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.1"}]}],"versions":["2.3.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/03/GHSA-2g9q-chq2-w8qw/GHSA-2g9q-chq2-w8qw.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}]}