Leon Johnson

**Name of the Vulnerable Software and Affected Versions** Apache Hive versions prior to 4.2.1 **Description** An issue exists in the Hive Metastore where direct SQL partition-name resolution allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata. This occurs when client-supplied partition names are embedded into SQL using string concatenation via the `DirectSqlUpdatePart.quoteString()` function instead of using bind parameters. A crafted partition name containing a single quote can alter the generated WHERE clause, causing lookups to match additional rows. This affects operations such as statistics updates, truncation targets, and file-metadata cache operations when the `metastore.try.direct.sql` variable is enabled. The impact is limited to table and partition targeting within tables the user can already reference, rather than arbitrary cross-database access. **Recommendations** Upgrade to version 4.2.1. As a temporary mitigation, disable the `metastore.try.direct.sql` variable.

**Name of the Vulnerable Software and Affected Versions** Apache ActiveMQ versions prior to 5.19.8 Apache ActiveMQ versions 6.0.0 through 6.2.6 **Description** An improper authorization issue exists where an authenticated user with low privileges can access the `/admin/*` endpoints in the Web Console. This occurs because the default Jetty settings fail to restrict these paths exclusively to administrators. **Recommendations** Upgrade to version 5.19.8. Upgrade to version 6.2.7.

**Name of the Vulnerable Software and Affected Versions** Apache ActiveMQ versions prior to 5.19.8 Apache ActiveMQ versions 6.0.0 through 6.2.6 **Description** An authorization flaw exists in the handling of temporary destinations. While these destinations are intended to be isolated to the connection that created them, the isolation check is only performed on the client side. This allows a different connection to consume messages from another connection's temporary destination. **Recommendations** Upgrade to version 6.2.7.

**Name of the Vulnerable Software and Affected Versions** Apache ActiveMQ versions prior to 5.19.7 Apache ActiveMQ versions 6.0.0 through 6.2.5 **Description** Incomplete authorization in the server allows authenticated connections to remove existing destinations when they possess the proper permissions. **Recommendations** Upgrade to version 5.19.7. Upgrade to version 6.2.6.

**Name of the Vulnerable Software and Affected Versions** Apache ActiveMQ versions prior to 5.19.7 Apache ActiveMQ versions 6.0.0 through 6.2.5 **Description** Incorrect default permissions in Jolokia authorization settings allow authenticated low-privilege web-login accounts to access operations intended for administrators. This enables non-admin users to execute broker management operations, such as `addQueue()` and `removeQueue()`. **Recommendations** Update versions prior to 5.19.7 to version 5.19.7. Update versions 6.0.0 through 6.2.5 to version 6.2.6.