Deserialization in Apache Hive
CVE-2022-41137
Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe and can lead to Remote Code Execution (RCE) since it allows the deserialization of arbitrary data. In real deployments, the vulnerability can be exploited only by authenticated users/clients that were able to successfully establish a connection to the Metastore. From an API perspective any code that calls the unsafe method may be vulnerable unless it performs additional prerechecks on the input arguments.
Vulnerability class: Insecure Deserialization
EPSS: 0.016 (75.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H.
Affected products
- Apache Hive — versions 4.0.0
- Apache Software Foundation Hive — versions 4.0.0-alpha-1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@apache.org (Product, product)
- security@apache.org (issue-tracking, Issue Tracking)
- security@apache.org (Patch, patch)
- security@apache.org (vendor-advisory, Mailing List, Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2022-41137?
- CVE-2022-41137 is a high-severity vulnerability in Apache Hive, classified under Deserialization of Untrusted Data. CVSS score: 8.3/10. Published 2024-12-05.
- How severe is CVE-2022-41137?
- High severity. CVSS v3 base score is 8.3 out of 10.
- Is CVE-2022-41137 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.