VYPR
← All advisories
Moderate severityNVD Advisory· Published Jan 28, 2025· Updated Jan 29, 2025

Apache Hive: Credentials file created with non restrictive permissions

CVE-2024-29869

Description

Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly. Any unauthorized user having access to the directory can read the sensitive information written into this file. Users are recommended to upgrade to version 4.0.1, which fixes this issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Apache Hive creates a credentials file with default permissions 644 in a temporary directory, allowing local unauthorized users to read sensitive information.

Vulnerability

CVE-2024-29869 affects Apache Hive versions from 1.1.0 up to 4.0.1. The vulnerability lies in the SecureCmdDoAs component where Hive creates a credentials file in a temporary directory with file permissions set to 644 (world-readable) by default when explicit file permissions are not configured [1][4]. This means the file is readable by any user on the system who has access to that temporary directory.

Exploitation

An attacker who is an unauthorized user with local access to the file system where Hive runs can read the credentials file. The attack requires that the attacker can access the temporary directory used by Hive. No special privileges or authentication bypass is needed beyond local user access [2][4].

Impact

Successful reading of the credentials file can expose sensitive information such as authentication tokens or passwords used by Hive to access other services. This can lead to unauthorized access to data or systems that Hive interacts with, potentially compromising the broader Hadoop ecosystem.

Mitigation

The issue is fixed in Apache Hive version 4.0.1 and 4.1.0 [1]. Users are recommended to upgrade to the latest patched version. There is no mention of this vulnerability being listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. No workarounds are provided in the references, but administrators can manually set restrictive file permissions as a temporary measure.

References
  1. [HIVE-28134] Improve SecureCmdDoAs - ASF Jira
  2. NVD - CVE-2024-29869
  3. security - CVE-2024-29869: Apache Hive: Credentials file created with non restrictive permissions

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.hive:hive-execMaven
< 4.0.14.0.1

Affected products

22

Patches

1
20106e254527

HIVE-28134: Improve SecureCmdDoAs. (#5140). (Ayush Saxena, reviewed by Sourabh Badhya)

https://github.com/apache/hiveAyush SaxenaMar 21, 2024via ghsa
commit
1 file changed · +9 −1
  • ql/src/java/org/apache/hadoop/hive/ql/exec/SecureCmdDoAs.java+9 −1 modified
    @@ -23,8 +23,10 @@
 import java.net.URISyntaxException;
 import java.util.Map;
 
+import org.apache.hadoop.fs.FSDataOutputStream;
 import org.apache.hadoop.fs.FileSystem;
 import org.apache.hadoop.fs.Path;
+import org.apache.hadoop.fs.permission.FsPermission;
 import org.apache.hadoop.hive.conf.HiveConf;
 import org.apache.hadoop.hive.ql.metadata.HiveException;
 import org.apache.hadoop.hive.shims.ShimLoader;
@@ -68,7 +70,13 @@ public SecureCmdDoAs(HiveConf conf) throws HiveException, IOException{
     tokenPath = new Path(tokenFile.toURI());
 
     //write credential with token to file
-    cred.writeTokenStorageFile(tokenPath, conf);
+    FsPermission umask = FsPermission.getUMask(conf);
+    FsPermission targetPerm = FsPermission.createImmutable((short) 0700);
+
+    try (FSDataOutputStream os = tokenPath.getFileSystem(conf).createFile(tokenPath)
+        .permission(targetPerm.applyUMask(umask)).build()) {
+      cred.writeTokenStorageToStream(os, Credentials.SerializedFormat.WRITABLE);
+    }
   }
 
   public void addEnv(Map<String, String> env){

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.