cbcvebase.
CVE-2022-41137
published 2024-12-05

CVE-2022-41137: Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe and…

PriorityP357high8.3CVSS 3.1
AVNACLPRLUINSUCLIHAH
EPSS
1.66%
73.8th percentile
Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe and can lead to Remote Code Execution (RCE) since it allows the deserialization of arbitrary data. In real deployments, the vulnerability can be exploited only by authenticated users/clients that were able to successfully establish a connection to the Metastore. From an API perspective any code that calls the unsafe method may be vulnerable unless it performs additional prerechecks on the input arguments.

Affected

2 ranges
VendorProductVersion rangeFixed in
apachehive
apache_software_foundationapache_hive>= 4.0.0-alpha-1 < 4.0.04.0.0

Detection & IOCsextracted from sources · hover to see the quote

  • Vulnerable method: SerializationUtilities#deserializeObjectWithTypeInformation is called when filtering and fetching partitions in Apache Hive Metastore — monitor or block invocations of this method with untrusted/arbitrary input
  • Exploitation requires an authenticated connection to the Hive Metastore — audit and alert on unexpected or anomalous authenticated Metastore connections, especially those triggering partition fetch/filter operations
  • Any API code path that calls SerializationUtilities#deserializeObjectWithTypeInformation without additional input validation is a potential attack vector — review and instrument all such call sites
  • ·Exploitation is limited to authenticated users/clients — unauthenticated remote exploitation is not possible in standard deployments
  • ·The vulnerability primarily impacts integrity and availability of the Hive warehouse metadata (tables and partitions), not just confidentiality
  • ·org.spark-project.hive/hive-metastore as shipped in Red Hat Integration Camel K 1 and Red Hat JBoss Data Grid 7 is NOT affected; the Red Hat Fuse 7 package is out of support scope

CVSS provenance

nvdv3.18.3HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
vendor_redhat8.3HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.