已开启
[sync] PR-40: fix CVE-2024-29869 #41
AtomGit-Bot创建于 2025年9月22日
[sync] PR-40: fix CVE-2024-29869 #41
已开启
共 2 个文件变更+47-1
| @@ -0,0 +1,40 @@ | |||
| 1 | +From 20106e254527f7d71b2e34455c4322e14950c620 Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: Ayush Saxena <ayushsaxena@apache.org> | ||
| 3 | +Date: Thu, 21 Mar 2024 10:56:21 +0530 | ||
| 4 | +Subject: [PATCH] HIVE-28134: Improve SecureCmdDoAs. (#5140). (Ayush Saxena, | ||
| 5 | + reviewed by Sourabh Badhya) | ||
| 6 | + | ||
| 7 | +--- | ||
| 8 | + .../org/apache/hadoop/hive/ql/exec/SecureCmdDoAs.java | 10 +++++++++- | ||
| 9 | + 1 file changed, 9 insertions(+), 1 deletion(-) | ||
| 10 | + | ||
| 11 | +diff --git a/ql/src/java/org/apache/hadoop/hive/ql/exec/SecureCmdDoAs.java b/ql/src/java/org/apache/hadoop/hive/ql/exec/SecureCmdDoAs.java | ||
| 12 | +index e9ede6abf68a..a2e9dab885d7 100644 | ||
| 13 | +--- a/ql/src/java/org/apache/hadoop/hive/ql/exec/SecureCmdDoAs.java | ||
| 14 | ++++ b/ql/src/java/org/apache/hadoop/hive/ql/exec/SecureCmdDoAs.java | ||
| 15 | + | ||
| 16 | + import java.net.URISyntaxException; | ||
| 17 | + import java.util.Map; | ||
| 18 | + | ||
| 19 | ++import org.apache.hadoop.fs.FSDataOutputStream; | ||
| 20 | + import org.apache.hadoop.fs.FileSystem; | ||
| 21 | + import org.apache.hadoop.fs.Path; | ||
| 22 | ++import org.apache.hadoop.fs.permission.FsPermission; | ||
| 23 | + import org.apache.hadoop.hive.conf.HiveConf; | ||
| 24 | + import org.apache.hadoop.hive.ql.metadata.HiveException; | ||
| 25 | + import org.apache.hadoop.hive.shims.ShimLoader; | ||
| 26 | + public SecureCmdDoAs(HiveConf conf) throws HiveException, IOException{ | ||
| 27 | + tokenPath = new Path(tokenFile.toURI()); | ||
| 28 | + | ||
| 29 | + //write credential with token to file | ||
| 30 | +- cred.writeTokenStorageFile(tokenPath, conf); | ||
| 31 | ++ FsPermission umask = FsPermission.getUMask(conf); | ||
| 32 | ++ FsPermission targetPerm = FsPermission.createImmutable((short) 0700); | ||
| 33 | ++ | ||
| 34 | ++ try (FSDataOutputStream os = tokenPath.getFileSystem(conf).createFile(tokenPath) | ||
| 35 | ++ .permission(targetPerm.applyUMask(umask)).build()) { | ||
| 36 | ++ cred.writeTokenStorageToStream(os, Credentials.SerializedFormat.WRITABLE); | ||
| 37 | ++ } | ||
| 38 | + } | ||
| 39 | + | ||
| 40 | + public void addEnv(Map<String, String> env){ | ||
| @@ -2,7 +2,7 @@ | |||
| 2 | 2 | ||
| 3 | Name: hive | 3 | Name: hive |
| 4 | Version: 3.1.3 | 4 | Version: 3.1.3 |
| 5 | -Release: 2 | 5 | +Release: 3 |
| 6 | Summary: The Apache Hadoop data warehouse | 6 | Summary: The Apache Hadoop data warehouse |
| 7 | 7 | ||
| 8 | License: Apache-2.0 and Python-2.0 and MPL-2.0 and BSD and ICU | 8 | License: Apache-2.0 and Python-2.0 and MPL-2.0 and BSD and ICU |
| @@ -21,6 +21,8 @@ Requires: hadoop-3.1-mapreduce hadoop-3.1-maven-plugin hadoop-3.1-yarn hadoop-3. | |||
| 21 | Requires: mysql-server | 21 | Requires: mysql-server |
| 22 | BuildArch: noarch | 22 | BuildArch: noarch |
| 23 | 23 | ||
| 24 | +Patch1000: backport-CVE-2024-29869.patch | ||
| 25 | + | ||
| 24 | %description | 26 | %description |
| 25 | The Apache Hive data warehouse software facilitates querying and | 27 | The Apache Hive data warehouse software facilitates querying and |
| 26 | managing large datasets residing in distributed storage. Apache Hive | 28 | managing large datasets residing in distributed storage. Apache Hive |
| @@ -29,6 +31,7 @@ the data using a SQL-like language called HiveQL. | |||
| 29 | 31 | ||
| 30 | %prep | 32 | %prep |
| 31 | %setup -q -n %{name}-rel-release-%{version} | 33 | %setup -q -n %{name}-rel-release-%{version} |
| 34 | +%patch1000 -p1 | ||
| 32 | mvn install:install-file -DgroupId=com.google.protobuf -DartifactId=protoc -Dversion=2.5.0 -Dclassifier=linux-aarch_64 -Dpackaging=exe -Dfile=/usr/bin/protoc | 35 | mvn install:install-file -DgroupId=com.google.protobuf -DartifactId=protoc -Dversion=2.5.0 -Dclassifier=linux-aarch_64 -Dpackaging=exe -Dfile=/usr/bin/protoc |
| 33 | mvn install:install-file -DgroupId=org.pentaho -DartifactId=pentaho-aggdesigner-algorithm -Dversion=5.1.5-jhyde -Dpackaging=jar -Dfile=%{SOURCE2} | 36 | mvn install:install-file -DgroupId=org.pentaho -DartifactId=pentaho-aggdesigner-algorithm -Dversion=5.1.5-jhyde -Dpackaging=jar -Dfile=%{SOURCE2} |
| 34 | cp %{SOURCE1} ./.xmvn-reactor | 37 | cp %{SOURCE1} ./.xmvn-reactor |
| @@ -127,6 +130,9 @@ ln -s %{_javadir}/%{name}/%{name}-shims.jar %{buildroot}%{_datadir}/hadoop/mapre | |||
| 127 | 130 | ||
| 128 | 131 | ||
| 129 | %changelog | 132 | %changelog |
| 133 | +* Thu Sep 18 2025 wang kun <wang_kun1@hoperun.com> 3.1.3-3 | ||
| 134 | +- fix CVE-2024-29869 | ||
| 135 | + | ||
| 130 | * Tue Sep 13 2022 Jie Dong <dongjie34@h-partners.com> 3.1.3-2 | 136 | * Tue Sep 13 2022 Jie Dong <dongjie34@h-partners.com> 3.1.3-2 |
| 131 | - Add requires mysql-server | 137 | - Add requires mysql-server |
| 132 | 138 | ||