Django REST framework

Lookup for vulnerable packages by Package URL.

Purl pkg:maven/org.apache.hive/hive-jdbc@1.0.0

Type maven

Namespace org.apache.hive

Name hive-jdbc

Version 1.0.0

Qualifiers

Subpath

Is_vulnerable true

Next_non_vulnerable_version 1.2.2

Latest_non_vulnerable_version 3.1.1

Affected_by_vulnerabilities

url VCID-me8z-qek2-wfgn

vulnerability_id VCID-me8z-qek2-wfgn

summary

Improper Certificate Validation
Apache Hive (JDBC + HiveServer2) implements SSL for plain TCP and HTTP connections (it supports both transport modes). While validating the server's certificate during the connection setup, the client in Apache Hive does not seem to be verifying the common name attribute of the certificate. In this way, if a JDBC client sends an SSL request to server `abc.com`, and the server responds with a valid certificate (certified by CA) but issued to `xyz.com`, the client will accept that as a valid certificate and the SSL handshake will go through.

references

reference_url	https://lists.apache.org/thread.html/0851bcf85635385f94cdaa008053802d92b4aab0a3075e30ed171192@%3Cdev.hive.apache.org%3E
reference_id
reference_type
scores
url	https://lists.apache.org/thread.html/0851bcf85635385f94cdaa008053802d92b4aab0a3075e30ed171192@%3Cdev.hive.apache.org%3E

reference_url	http://www.securityfocus.com/bid/98669
reference_id
reference_type
scores
url	http://www.securityfocus.com/bid/98669

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2016-3083
reference_id	CVE-2016-3083
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2016-3083

reference_url	https://github.com/advisories/GHSA-gf2v-9hp6-44qg
reference_id	GHSA-gf2v-9hp6-44qg
reference_type
scores
url	https://github.com/advisories/GHSA-gf2v-9hp6-44qg

fixed_packages

url	pkg:maven/org.apache.hive/hive-jdbc@1.2.2
purl	pkg:maven/org.apache.hive/hive-jdbc@1.2.2
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.hive/hive-jdbc@1.2.2

aliases CVE-2016-3083, GHSA-gf2v-9hp6-44qg

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-me8z-qek2-wfgn

Fixing_vulnerabilities

Risk_score null

Resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.hive/hive-jdbc@1.0.0

Package Instance