VYPR
Get started
← All advisories
High severity7.5NVD Advisory· Published May 30, 2017· Updated May 13, 2026

CVE-2016-3083

CVE-2016-3083

Description

Apache Hive (JDBC + HiveServer2) implements SSL for plain TCP and HTTP connections (it supports both transport modes). While validating the server's certificate during the connection setup, the client in Apache Hive before 1.2.2 and 2.0.x before 2.0.1 doesn't seem to be verifying the common name attribute of the certificate. In this way, if a JDBC client sends an SSL request to server abc.com, and the server responds with a valid certificate (certified by CA) but issued to xyz.com, the client will accept that as a valid certificate and the SSL handshake will go through.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.hive:hiveMaven
< 1.2.21.2.2
org.apache.hive:hiveMaven
>= 2.0.0, < 2.0.12.0.1
org.apache.hive:hive-serviceMaven
< 1.2.21.2.2
org.apache.hive:hive-serviceMaven
>= 2.0.0, < 2.0.12.0.1
org.apache.hive:hive-execMaven
< 1.2.21.2.2
org.apache.hive:hive-execMaven
>= 2.0.0, < 2.0.12.0.1

Affected products

10
  • Apache/Hive9 versions
    cpe:2.3:a:apache:hive:0.13.0:*:*:*:*:*:*:*+ 8 more
    • cpe:2.3:a:apache:hive:0.13.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:hive:0.13.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:hive:0.14.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:hive:1.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:hive:1.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:hive:1.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:hive:1.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:hive:1.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:hive:1.2.1:*:*:*:*:*:*:*
  • Apache Software Foundation/Apache Hivev5
    Range: 0.11.0 - 0.14.0

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

5

News mentions

0

No linked articles in our index yet.