Apache Hive Credentials File Permission Vulnerability

A vulnerability exists in Apache Hive versions 1.1.0 prior to 4.0.1, where a credentials file is created in a temporary directory with default permissions of 644. This allows any unauthorized user with access to the directory to read the sensitive information in the file. The issue arises because the file permissions are not explicitly set, leaving the credentials exposed to unauthorized access.

Impact

The vulnerability allows unauthorized users to read sensitive information from the credentials file.

Remediation

Users are advised to upgrade to Apache Hive version 4.0.1, which addresses this vulnerability.