SB2025062649 - Incorrect permission assignment for critical resource in Apache Hive
Published: June 26, 2025
Security Bulletin ID
SB2025062649
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Incorrect permission assignment for critical resource (CVE-ID: CVE-2024-29869)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly. A local user with access to the directory can read the sensitive information written into this file.
Remediation
Install update from vendor's website.