Description
The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, mishandles simple unauthenticated and anonymous bind configurations, which allows remote attackers to bypass authentication via a crafted LDAP request.
Remediation
References
http://mail-archives.apache.org/mod_mbox/www-announce/201505.mbox/%3CCAOpgucy52yzNN1FaRcxwhZmx8ZtNRjmK6V0Bxk4svAD-R1q70Q%40mail.gmail.com%3E
http://www-01.ibm.com/support/docview.wss?uid=swg21969546
http://www.securitytracker.com/id/1034365
https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html
Related Vulnerabilities
CVE-2023-32262 Vulnerability in maven package org.jenkins-ci.plugins:dimensionsscm
CVE-2019-10345 Vulnerability in maven package io.jenkins:configuration-as-code
CVE-2020-7651 Vulnerability in npm package snyk-broker
CVE-2021-21344 Vulnerability in maven package com.thoughtworks.xstream:xstream
CVE-2023-2631 Vulnerability in maven package org.jenkins-ci.plugins:codedx