Django REST framework

Lookup for vulnerable packages by Package URL.

Purl pkg:maven/org.apache.hive/hive-metastore@4.1.0

Type maven

Namespace org.apache.hive

Name hive-metastore

Version 4.1.0

Qualifiers

Subpath

Is_vulnerable true

Next_non_vulnerable_version 4.2.0

Latest_non_vulnerable_version 4.2.0

Affected_by_vulnerabilities

url VCID-3fkt-2872-fqbq

vulnerability_id VCID-3fkt-2872-fqbq

summary

Hive Metastore Server is vulnerable to SQL Injection
SQL injection vulnerability in Hive Metastore Server (HMS) when processing delete column statistics requests via the Thrift APIs. The vulnerability is only exploitable by trusted/authorized users/applications that are allowed to call directly the Thrift APIs. In most real-world deployments, HMS is accessible to only a handful of applications (e.g., Hiveserver2) thus the vulnerability is not exploitable. Moreover, the vulnerable code cannot be reached when metastore.try.direct.sql property is set to false.

This issue affects Apache Hive: from 4.1.0 before 4.2.0.

Users are recommended to upgrade to version 4.2.0, which fixes the issue. Users who cannot upgrade directly are encouraged to set metastore.try.direct.sql property to false if the HMS Thrift APIs are exposed to general public.

references

reference_url	https://github.com/apache/hive
reference_id
reference_type
scores
url	https://github.com/apache/hive

reference_url	https://github.com/apache/hive/commit/c18d0df2702130cf5d0f050e516eb8999aa56301
reference_id
reference_type
scores
url	https://github.com/apache/hive/commit/c18d0df2702130cf5d0f050e516eb8999aa56301

reference_url	https://issues.apache.org/jira/browse/HIVE-29269
reference_id
reference_type
scores
url	https://issues.apache.org/jira/browse/HIVE-29269

reference_url	https://lists.apache.org/thread/yj65dd8dmzgy8p3nv8zy33v8knzg9o7g
reference_id
reference_type
scores
url	https://lists.apache.org/thread/yj65dd8dmzgy8p3nv8zy33v8knzg9o7g

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2025-62728
reference_id	CVE-2025-62728
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2025-62728

reference_url	https://github.com/advisories/GHSA-932v-x9x2-vq29
reference_id	GHSA-932v-x9x2-vq29
reference_type
scores
url	https://github.com/advisories/GHSA-932v-x9x2-vq29

fixed_packages

url	pkg:maven/org.apache.hive/hive-metastore@4.2.0
purl	pkg:maven/org.apache.hive/hive-metastore@4.2.0
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.hive/hive-metastore@4.2.0

aliases CVE-2025-62728, GHSA-932v-x9x2-vq29

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-3fkt-2872-fqbq

Fixing_vulnerabilities

Risk_score null

Resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.hive/hive-metastore@4.1.0

Package Instance