CVE-2024-29869 Apache Hive: Credentials file created with non restrictive permissions
An attacker with local access can read sensitive credentials from a Hive temporary file due to insecure default permissions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-29869?
CVE-2024-29869 is a medium-severity vulnerability in Apache Hive, published on 28 Jan 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly. Any unauthorized user having access to the directory can read the sensitive information written into this file. Users are recommended to upgrade to version 4.0.1, which fixes this issue.
Weakness: CWE-732
Which versions are affected by CVE-2024-29869?
2 open source packages ship an affected version, including org.apache.hive:hive-exec. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.hive:hive-exec Maven | All versions | 4.0.1 |
org.apache.hive:hive-exec Maven | All versions | 4.0.1 |
Products include Apache Hive.
How do I fix CVE-2024-29869?
Upgrade org.apache.hive:hive-exec to 4.0.1 or later.
Is CVE-2024-29869 being exploited?
There is no known exploitation of CVE-2024-29869 in the wild and no public exploit code.
Other vulnerabilities in Apache Hive
- CVE-2026-49845 Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths
- CVE-2018-21234 Deserialization of Untrusted Data in Jodd
- CVE-2026-55976 Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url
- CVE-2018-1282 SQL Injection in hive-jdbc
- CVE-2022-41137 Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore
Sources
Also known as CLEANSTART-2026-GO41173, CLSA-2026-1780966326, ECHO-ea2f-35d1-c90a, GHSA-c476-j253-5rgq, MINI-4mr6-fgqf-phjq, MINI-7xh2-g9h2-2xhw and 1 more.