CVE-2022-41137 Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore
Authenticated attackers can achieve remote code execution in Apache Hive Metastore via unsafe deserialization when fetching partitions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-41137?
CVE-2022-41137 is a high-severity unsafe deserialization vulnerability in Apache Hive, published on 5 Dec 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe and can lead to Remote Code Execution (RCE) since it allows the deserialization of arbitrary data.
In real deployments, the vulnerability can be exploited only by authenticated users/clients that were able to successfully establish a connection to the Metastore. From an API perspective any code that calls the unsafe method may be vulnerable unless it performs additional prerechecks on the input arguments.
Weakness: CWE-502
Which versions are affected by CVE-2022-41137?
2 open source packages ship an affected version, including org.apache.hive:hive-exec. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.hive:hive-exec Maven | From 4.0.0-alpha-1 | 4.0.0-alpha-2 |
org.apache.hive:hive-exec Maven | From 4.0.0-alpha-1 | 4.0.0-alpha-2 |
Products include Apache Hive.
How do I fix CVE-2022-41137?
Upgrade org.apache.hive:hive-exec to 4.0.0-alpha-2 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2022-41137 being exploited?
There is no known exploitation of CVE-2022-41137 in the wild and no public exploit code.
Other vulnerabilities in Apache Hive
- CVE-2026-49845 Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths
- CVE-2018-21234 Deserialization of Untrusted Data in Jodd
- CVE-2026-55976 Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url
- CVE-2018-1282 SQL Injection in hive-jdbc
- CVE-2015-7521 High severity vulnerability that affects org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service
Sources
Also known as GHSA-6hqr-c69m-r76q.