已开启
fix(hive): backport CVE-2024-29869 for openEuler-24.03-LTS-SP4 #46
pop-code123创建于 6月10日
fix(hive): backport CVE-2024-29869 for openEuler-24.03-LTS-SP4 #46
已开启
共 2 个文件变更+47-1
| @@ -0,0 +1,40 @@ | |||
| 1 | +From 20106e254527f7d71b2e34455c4322e14950c620 Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: Ayush Saxena <ayushsaxena@apache.org> | ||
| 3 | +Date: Thu, 21 Mar 2024 10:56:21 +0530 | ||
| 4 | +Subject: [PATCH] HIVE-28134: Improve SecureCmdDoAs. (#5140). (Ayush Saxena, | ||
| 5 | + reviewed by Sourabh Badhya) | ||
| 6 | + | ||
| 7 | +--- | ||
| 8 | + .../org/apache/hadoop/hive/ql/exec/SecureCmdDoAs.java | 10 +++++++++- | ||
| 9 | + 1 file changed, 9 insertions(+), 1 deletion(-) | ||
| 10 | + | ||
| 11 | +diff --git a/ql/src/java/org/apache/hadoop/hive/ql/exec/SecureCmdDoAs.java b/ql/src/java/org/apache/hadoop/hive/ql/exec/SecureCmdDoAs.java | ||
| 12 | +index e9ede6abf68a..a2e9dab885d7 100644 | ||
| 13 | +--- a/ql/src/java/org/apache/hadoop/hive/ql/exec/SecureCmdDoAs.java | ||
| 14 | ++++ b/ql/src/java/org/apache/hadoop/hive/ql/exec/SecureCmdDoAs.java | ||
| 15 | + | ||
| 16 | + import java.net.URISyntaxException; | ||
| 17 | + import java.util.Map; | ||
| 18 | + | ||
| 19 | ++import org.apache.hadoop.fs.FSDataOutputStream; | ||
| 20 | + import org.apache.hadoop.fs.FileSystem; | ||
| 21 | + import org.apache.hadoop.fs.Path; | ||
| 22 | ++import org.apache.hadoop.fs.permission.FsPermission; | ||
| 23 | + import org.apache.hadoop.hive.conf.HiveConf; | ||
| 24 | + import org.apache.hadoop.hive.ql.metadata.HiveException; | ||
| 25 | + import org.apache.hadoop.hive.shims.ShimLoader; | ||
| 26 | + public SecureCmdDoAs(HiveConf conf) throws HiveException, IOException{ | ||
| 27 | + tokenPath = new Path(tokenFile.toURI()); | ||
| 28 | + | ||
| 29 | + //write credential with token to file | ||
| 30 | +- cred.writeTokenStorageFile(tokenPath, conf); | ||
| 31 | ++ FsPermission umask = FsPermission.getUMask(conf); | ||
| 32 | ++ FsPermission targetPerm = FsPermission.createImmutable((short) 0700); | ||
| 33 | ++ | ||
| 34 | ++ try (FSDataOutputStream os = tokenPath.getFileSystem(conf).createFile(tokenPath) | ||
| 35 | ++ .permission(targetPerm.applyUMask(umask)).build()) { | ||
| 36 | ++ cred.writeTokenStorageToStream(os, Credentials.SerializedFormat.WRITABLE); | ||
| 37 | ++ } | ||
| 38 | + } | ||
| 39 | + | ||
| 40 | + public void addEnv(Map<String, String> env){ | ||
| @@ -2,7 +2,7 @@ | |||
| 2 | 2 | ||
| 3 | Name: hive | 3 | Name: hive |
| 4 | Version: 3.1.3 | 4 | Version: 3.1.3 |
| 5 | -Release: 3 | 5 | +Release: 4 |
| 6 | Summary: The Apache Hadoop data warehouse | 6 | Summary: The Apache Hadoop data warehouse |
| 7 | 7 | ||
| 8 | License: Apache-2.0 and Python-2.0 and MPL-2.0 and BSD and ICU | 8 | License: Apache-2.0 and Python-2.0 and MPL-2.0 and BSD and ICU |
| @@ -16,6 +16,8 @@ Source4: mysql-connector-java.jar | |||
| 16 | Source5: protoc-jar-3.5.1.1.tar.gz | 16 | Source5: protoc-jar-3.5.1.1.tar.gz |
| 17 | Source6: protoc-jar-maven-plugin-3.5.1.1.tar.gz | 17 | Source6: protoc-jar-maven-plugin-3.5.1.1.tar.gz |
| 18 | 18 | ||
| 19 | +Patch1000: backport-CVE-2024-29869.patch | ||
| 20 | + | ||
| 19 | BuildRequires: cmake java-1.8.0-openjdk-devel maven xmvn xmvn-install gradle-local maven-local protobuf2-devel protobuf2-compiler | 21 | BuildRequires: cmake java-1.8.0-openjdk-devel maven xmvn xmvn-install gradle-local maven-local protobuf2-devel protobuf2-compiler |
| 20 | Requires: java-1.8.0-openjdk | 22 | Requires: java-1.8.0-openjdk |
| 21 | BuildArch: noarch | 23 | BuildArch: noarch |
| @@ -28,6 +30,7 @@ the data using a SQL-like language called HiveQL. | |||
| 28 | 30 | ||
| 29 | %prep | 31 | %prep |
| 30 | %setup -q -n %{name}-rel-release-%{version} | 32 | %setup -q -n %{name}-rel-release-%{version} |
| 33 | +%patch 1000 -p1 | ||
| 31 | mvn install:install-file -DgroupId=com.google.protobuf -DartifactId=protoc -Dversion=2.5.0 -Dclassifier=linux-aarch_64 -Dpackaging=exe -Dfile=/usr/bin/protoc | 34 | mvn install:install-file -DgroupId=com.google.protobuf -DartifactId=protoc -Dversion=2.5.0 -Dclassifier=linux-aarch_64 -Dpackaging=exe -Dfile=/usr/bin/protoc |
| 32 | mvn install:install-file -DgroupId=org.pentaho -DartifactId=pentaho-aggdesigner-algorithm -Dversion=5.1.5-jhyde -Dpackaging=jar -Dfile=%{SOURCE2} | 35 | mvn install:install-file -DgroupId=org.pentaho -DartifactId=pentaho-aggdesigner-algorithm -Dversion=5.1.5-jhyde -Dpackaging=jar -Dfile=%{SOURCE2} |
| 33 | %if "%{_arch}" == "riscv64" | 36 | %if "%{_arch}" == "riscv64" |
| @@ -132,6 +135,9 @@ ln -s %{_javadir}/%{name}/%{name}-shims.jar %{buildroot}%{_datadir}/hadoop/mapre | |||
| 132 | 135 | ||
| 133 | 136 | ||
| 134 | %changelog | 137 | %changelog |
| 138 | +* Wed Jun 10 2026 puhongyu <puhongyu@kylinsec.com.cn> - 3.1.3-4 | ||
| 139 | +- fix CVE-2024-29869 | ||
| 140 | + | ||
| 135 | * Wed May 29 2024 Dingli Zhang <dingli@iscas.ac.cn> - 3.1.3-3 | 141 | * Wed May 29 2024 Dingli Zhang <dingli@iscas.ac.cn> - 3.1.3-3 |
| 136 | - Fix riscv64 support | 142 | - Fix riscv64 support |
| 137 | 143 | ||