{
  "@id": "urn:uuid:470dc3f9-22d3-4ed6-8409-98d82122f1a6",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 11,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-11T10:37:59.182254+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.hive/hive-common@2.3.9-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.hive/hive-common@2.3.9-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-27T21:35:14.301138+00:00",
      "status_notes": "Vulnerability CVE-2025-27888 does not affect version 2.3.9-tuxcare.4 of org.apache.hive:hive-common. not_affected \u2014 Apache Hive 2.3.9-tuxcare.3 is NOT affected by CVE-2025-27888. This CVE concerns the Apache Druid management proxy (a server-side component), but Hive's druid-handler module contains only CLIENT code that makes HTTP requests TO Druid servers. The vulnerable management proxy component is not present in Hive's codebase, nor does Hive execute the vulnerable code path. Hive depends on io.druid:drui...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-27888"
      },
      "impact_statement": "not_affected \u2014 Apache Hive 2.3.9-tuxcare.3 is NOT affected by CVE-2025-27888. This CVE concerns the Apache Druid management proxy (a server-side component), but Hive's druid-handler module contains only CLIENT code that makes HTTP requests TO Druid servers. The vulnerable management proxy component is not present in Hive's codebase, nor does Hive execute the vulnerable code path. Hive depends on io.druid:drui..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.hive/hive-common@2.3.9-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.hive/hive-common@2.3.9-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T10:37:59.182254+00:00",
      "status_notes": "Vulnerability CVE-2025-59390 affects version 2.3.9-tuxcare.4 of org.apache.hive:hive-common, and is fixed in 2.3.9-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2025-59390"
      },
      "action_statement": "Vulnerability CVE-2025-59390 affects version 2.3.9-tuxcare.4 of org.apache.hive:hive-common, and is fixed in 2.3.9-tuxcare.7."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.hive/hive-common@2.3.9-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.hive/hive-common@2.3.9-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:17:20.138118+00:00",
      "status_notes": "Vulnerability CVE-2025-62728 does not affect version 2.3.9-tuxcare.4 of org.apache.hive:hive-common. not_affected \u2014 Apache Hive version 2.3.9 is not affected by CVE-2025-62728. The vulnerability is a SQL injection in the direct SQL code path for deleting column statistics, which was introduced in version 4.1.0. Version 2.3.9 predates this feature - it only contains JDO-based delete operations that use parameterized queries and are safe from SQL injection. The MetaStoreDirectSql class in 2.3.9 has no delete m...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2025-62728"
      },
      "impact_statement": "not_affected \u2014 Apache Hive version 2.3.9 is not affected by CVE-2025-62728. The vulnerability is a SQL injection in the direct SQL code path for deleting column statistics, which was introduced in version 4.1.0. Version 2.3.9 predates this feature - it only contains JDO-based delete operations that use parameterized queries and are safe from SQL injection. The MetaStoreDirectSql class in 2.3.9 has no delete m..."
    }
  ]
}