Bug 207173 - devel/hive: Apache Hive authorization bug disclosure in 1.2.1 (CVE-2015-7521)
Summary: devel/hive: Apache Hive authorization bug disclosure in 1.2.1 (CVE-2015-7521)
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Some People
Assignee: Dmitry Sivachenko
URL: http://www.openwall.com/lists/oss-sec...
Keywords: needs-patch, needs-qa, security
Depends on:
Blocks:
 
Reported: 2016-02-14 00:40 UTC by Jason Unovitch
Modified: 2016-07-03 19:35 UTC (History)
1 user (show)

See Also:
bugzilla: maintainer-feedback? (demon)
junovitch: merge-quarterly?

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Jason Unovitch freebsd_committer freebsd_triage 2016-02-14 00:40:32 UTC 
Reference: http://www.openwall.com/lists/oss-security/2016/01/28/12

It looks like we will have to include the parent-auth-hook from http://apache.arvixe.com/hive/hive-parent-auth-hook/, bump portrevision, and document the mitigation steps in VuXML.
Comment 1 Dmitry Sivachenko freebsd_committer freebsd_triage 2016-03-13 13:31:12 UTC 
I updated hive port to version 2.0, which has this bug fixed as far as I can tell.
Comment 2 commit-hook freebsd_committer freebsd_triage 2016-07-03 19:31:17 UTC 
A commit references this bug:

Author: junovitch
Date: Sun Jul  3 19:30:16 UTC 2016
New revision: 417994
URL: https://svnweb.freebsd.org/changeset/ports/417994

Log:
  Document authorization logic vulnerability in Apache Hive

  PR:		207173
  Security:	CVE-2015-7521
  Security:	https://vuxml.FreeBSD.org/freebsd/a5c204b5-4153-11e6-8dfe-002590263bf5.html

Changes:
  head/security/vuxml/vuln.xml
Comment 3 Jason Unovitch freebsd_committer freebsd_triage 2016-07-03 19:35:25 UTC 
Fixed since https://svnweb.FreeBSD.org/changeset/ports/410948 as mentioned by Dmitry in comment 1.

Did not document the mitigation recommendations since we just jumped right to 2.0.0 in ports so the entry documents < 2.0.0.  Delay in PR followup and VuXML is all mine.  Sorry for that.