[
https://issues.apache.org/jira/browse/HIVE-29622?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Sai Hemanth Gantasala updated HIVE-29622:
-----------------------------------------
Security: (was: Non-Public)
> Potential vulnerability in HiveMetaStore partition-name direct-SQL paths
> ------------------------------------------------------------------------
>
> Key: HIVE-29622
> URL: https://issues.apache.org/jira/browse/HIVE-29622
> Project: Hive
> Issue Type: Bug
> Components: Hive, Standalone Metastore
> Affects Versions: 4.2.0
> Reporter: Sai Hemanth Gantasala
> Assignee: Sai Hemanth Gantasala
> Priority: Critical
> Fix For: 4.2.1
>
>
> Several Hive Metastore RPCs resolve partitions by full partition name
> (PART_NAME) through direct-SQL helpers. In those paths, client-supplied
> partition names are embedded into SQL using string concatenation
> (DirectSqlUpdatePart.quoteString() → '...') instead of bind parameters.
> A partition name containing a single quote (and crafted SQL) can alter the
> generated WHERE clause so that lookups intended for one partition match
> additional rows. That can affect reads, stats updates, truncate targets,
> metadata-cache targets, and related operations when metastore.try.direct.sql
> is enabled (default: true).
> This is related to the same general attack surface as HIVE-29269 (delete
> column-stats direct SQL), which was fixed with prepared statements;
> partition-name lookup/update paths were not fully migrated.
> More details to be added later.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
