Riju Trivedi created HIVE-30239:
-----------------------------------
Summary: Upgrade pac4j to 5.7.10 to address CVE-2026-40458
Key: HIVE-30239
URL: https://issues.apache.org/jira/browse/HIVE-30239
Project: Hive
Issue Type: Task
Affects Versions: 4.2.1
Reporter: Riju Trivedi
Assignee: Riju Trivedi
Hive master currently uses pac4j 4.5.8 (pac4j-saml-opensamlv3 for HS2 SAML,
pac4j-core in metastore-server for JWT). The 4.x line is end-of-life and
receives no further security fixes.Hive itself does not use pac4j's CSRF support
so direct exposure is low. However, 4.x is unmaintained, vulnerability scanners
flag the
shipped pac4j-core jar (lib/, hive-jdbc standalone jar, metastore), and the
only supported
lines with the fix are 5.7.10+ and 6.4.1+.
Proposal: move to pac4j 5.7.10.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
