CVE-2022-41137
published 2024-12-05CVE-2022-41137: Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe and…
PriorityP357high8.3CVSS 3.1
AVNACLPRLUINSUCLIHAH
EPSS
1.66%
73.8th percentile
Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe and can lead to Remote Code Execution (RCE) since it allows the deserialization of arbitrary data.
In real deployments, the vulnerability can be exploited only by authenticated users/clients that were able to successfully establish a connection to the Metastore. From an API perspective any code that calls the unsafe method may be vulnerable unless it performs additional prerechecks on the input arguments.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | hive | — | — |
| apache_software_foundation | apache_hive | >= 4.0.0-alpha-1 < 4.0.0 | 4.0.0 |
Detection & IOCsextracted from sources · hover to see the quote
- →Vulnerable method: SerializationUtilities#deserializeObjectWithTypeInformation is called when filtering and fetching partitions in Apache Hive Metastore — monitor or block invocations of this method with untrusted/arbitrary input ↗
- →Exploitation requires an authenticated connection to the Hive Metastore — audit and alert on unexpected or anomalous authenticated Metastore connections, especially those triggering partition fetch/filter operations ↗
- →Any API code path that calls SerializationUtilities#deserializeObjectWithTypeInformation without additional input validation is a potential attack vector — review and instrument all such call sites ↗
- ·Exploitation is limited to authenticated users/clients — unauthenticated remote exploitation is not possible in standard deployments ↗
- ·The vulnerability primarily impacts integrity and availability of the Hive warehouse metadata (tables and partitions), not just confidentiality ↗
- ·org.spark-project.hive/hive-metastore as shipped in Red Hat Integration Camel K 1 and Red Hat JBoss Data Grid 7 is NOT affected; the Red Hat Fuse 7 package is out of support scope ↗
CVSS provenance
nvdv3.18.3HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
vendor_redhat8.3HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
hive-metastore: org.apache.hive:hive-metastore: Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore
vendor_redhat·2024-12-05·CVSS 8.3
CVE-2022-41137 [HIGH] CWE-502 hive-metastore: org.apache.hive:hive-metastore: Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore
hive-metastore: org.apache.hive:hive-metastore: Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore
Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe and can lead to Remote Code Execution (RCE) since it allows the deserialization of arbitrary data.
In real deployments, the vulnerability can be exploited only by authenticated users/clients that were able to successfully establish a connection to the Metastore. From an API perspective any code that calls the unsafe method may be vulnerable unless it performs additional prerechecks on the input arguments.
A flaw was found in the Apache Hive Metastore (HMS). This vulnerability allows remote code execu
GHSA
Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore
ghsa·2024-12-05
CVE-2022-41137 [HIGH] CWE-502 Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore
Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore
Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe and can lead to Remote Code Execution (RCE) since it allows the deserialization of arbitrary data.
In real deployments, the vulnerability can be exploited only by authenticated users/clients that were able to successfully establish a connection to the Metastore. From an API perspective any code that calls the unsafe method may be vulnerable unless it performs additional prerechecks on the input arguments.
OSV
Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore
osv·2024-12-05
CVE-2022-41137 [HIGH] Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore
Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore
Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe and can lead to Remote Code Execution (RCE) since it allows the deserialization of arbitrary data.
In real deployments, the vulnerability can be exploited only by authenticated users/clients that were able to successfully establish a connection to the Metastore. From an API perspective any code that calls the unsafe method may be vulnerable unless it performs additional prerechecks on the input arguments.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-12-05
Published