{
  "@id": "urn:uuid:1ca2be20-c0e3-4c45-a7db-23ef3dbaa89b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-11T10:37:59.182254+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.hive/hive-jdbc@2.3.9-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.hive/hive-jdbc@2.3.9-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T10:37:30.871242+00:00",
      "status_notes": "Vulnerability CVE-2018-1282 does not affect version 2.3.9-tuxcare.7 of org.apache.hive:hive-jdbc. CVE-2018-1282 is NOT present in Apache Hive 2.3.9-tuxcare.4. The vulnerability allowed SQL injection via crafted escape sequences in PreparedStatement parameters. The fix was already included in the upstream Apache Hive 2.3.9 release that TuxCare onboarded. Commit 63df42966c (authored by Daniel Dai from Hortonworks on March 2, 2018) added the `replaceBackSlashSingleQuote()` method to normalize backslash-escaped quotes before standard escaping, preventing bypass attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 0.7.1, < 2.3.3), NVD (>= 0.7.1, <= 2.3.2), cve.org (>= 0.7.1, <= 2.3.2), Snyk (>= 0.7.1, < 2.3.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1282"
      },
      "impact_statement": "CVE-2018-1282 is NOT present in Apache Hive 2.3.9-tuxcare.4. The vulnerability allowed SQL injection via crafted escape sequences in PreparedStatement parameters. The fix was already included in the upstream Apache Hive 2.3.9 release that TuxCare onboarded. Commit 63df42966c (authored by Daniel Dai from Hortonworks on March 2, 2018) added the `replaceBackSlashSingleQuote()` method to normalize backslash-escaped quotes before standard escaping, preventing bypass attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 0.7.1, < 2.3.3), NVD (>= 0.7.1, <= 2.3.2), cve.org (>= 0.7.1, <= 2.3.2), Snyk (>= 0.7.1, < 2.3.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.hive/hive-jdbc@2.3.9-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.hive/hive-jdbc@2.3.9-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T10:37:30.871242+00:00",
      "status_notes": "Vulnerability CVE-2018-1314 does not affect version 2.3.9-tuxcare.7 of org.apache.hive:hive-jdbc. not_affected \u2014 The target Apache Hive 2.3.9-tuxcare.4 is not affected by CVE-2018-1314. The vulnerability was fixed in upstream Apache Hive 2.3.4 via commit 3b1d4fdfdf by Daniel Dai (daijyc@gmail.com). The fix ensures EXPLAIN operations capture input/output entities for authorization verification. Since the target version 2.3.9 is based on an upstream release that already included this fix, the vulnerable cod...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1314"
      },
      "impact_statement": "not_affected \u2014 The target Apache Hive 2.3.9-tuxcare.4 is not affected by CVE-2018-1314. The vulnerability was fixed in upstream Apache Hive 2.3.4 via commit 3b1d4fdfdf by Daniel Dai (daijyc@gmail.com). The fix ensures EXPLAIN operations capture input/output entities for authorization verification. Since the target version 2.3.9 is based on an upstream release that already included this fix, the vulnerable cod..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.hive/hive-jdbc@2.3.9-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.hive/hive-jdbc@2.3.9-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T10:37:30.871242+00:00",
      "status_notes": "Vulnerability CVE-2023-35701 does not affect version 2.3.9-tuxcare.7 of org.apache.hive:hive-jdbc. not_affected \u2014 Apache Hive 2.3.9 is NOT AFFECTED by CVE-2023-35701. The CVE explicitly states the affected version range is \"from 4.0.0-alpha-1 before 4.0.0\". Target version 2.3.9 predates this range. Code analysis confirms that while the JDBC driver has an initFile parameter for SQL execution from local files, this parameter is client-controlled (from JDBC URL session variables) and cannot be manipulated by ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-35701"
      },
      "impact_statement": "not_affected \u2014 Apache Hive 2.3.9 is NOT AFFECTED by CVE-2023-35701. The CVE explicitly states the affected version range is \"from 4.0.0-alpha-1 before 4.0.0\". Target version 2.3.9 predates this range. Code analysis confirms that while the JDBC driver has an initFile parameter for SQL execution from local files, this parameter is client-controlled (from JDBC URL session variables) and cannot be manipulated by ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.hive/hive-jdbc@2.3.9-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.hive/hive-jdbc@2.3.9-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T10:37:30.871242+00:00",
      "status_notes": "Vulnerability CVE-2025-27888 does not affect version 2.3.9-tuxcare.7 of org.apache.hive:hive-jdbc. not_affected \u2014 Apache Hive 2.3.9-tuxcare.3 is NOT affected by CVE-2025-27888. This CVE concerns the Apache Druid management proxy (a server-side component), but Hive's druid-handler module contains only CLIENT code that makes HTTP requests TO Druid servers. The vulnerable management proxy component is not present in Hive's codebase, nor does Hive execute the vulnerable code path. Hive depends on io.druid:drui...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-27888"
      },
      "impact_statement": "not_affected \u2014 Apache Hive 2.3.9-tuxcare.3 is NOT affected by CVE-2025-27888. This CVE concerns the Apache Druid management proxy (a server-side component), but Hive's druid-handler module contains only CLIENT code that makes HTTP requests TO Druid servers. The vulnerable management proxy component is not present in Hive's codebase, nor does Hive execute the vulnerable code path. Hive depends on io.druid:drui..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.hive/hive-jdbc@2.3.9-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.hive/hive-jdbc@2.3.9-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T10:37:59.182254+00:00",
      "status_notes": "Vulnerability CVE-2025-59390 is fixed in version 2.3.9-tuxcare.7 of org.apache.hive:hive-jdbc.",
      "vulnerability": {
        "name": "CVE-2025-59390"
      }
    }
  ]
}