CVE-2024-29869
Apache Hive: Credentials file created with non restrictive permissions
Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly. Any unauthorized user having access to the directory can read the sensitive information written into this file. Users are recommended to upgrade to version 4.0.1, which fixes this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Apache Hive: Credentials file created with non restrictive permissions
Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly. Any unauthorized user having access to the directory can read the sensitive information written into this file. Users are recommended to upgrade to version 4.0.1, which fixes this issue.
- Record
CVE-2024-29869- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-732
- Updated
- 2026-11-02
EUVDEUVD-2025-0152
Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly. Any unauthorized user having access to the directory can read the sensitive information written into this file. Users are recommended to upgrade to version 4.0.1, which fixes this issue.
- Record
EUVD-2025-0152- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c476-j253-5rgq
Apache Hive Incorrectly Assigns Permissions for a Critical Resource
Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly. Any unauthorized user having access to the directory can read the sensitive information written into this file. Users are recommended to upgrade to version 4.0.1, which fixes this issue.
- Record
GHSA-c476-j253-5rgq- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-732
- Updated
- 2026-11-02
NVD
Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly. Any unauthorized user having access to the directory can read the sensitive information written into this file. Users are recommended to upgrade to version 4.0.1, which fixes this issue.
- Record
CVE-2024-29869- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-732
- Updated
- 2026-11-02
OSV
Apache Hive: Credentials file created with non restrictive permissions
Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly. Any unauthorized user having access to the directory can read the sensitive information written into this file. Users are recommended to upgrade to version 4.0.1, which fixes this issue.
- Record
CVE-2024-29869- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-732
- Updated
- 2026-11-02
OSVGHSA-c476-j253-5rgq
Apache Hive Incorrectly Assigns Permissions for a Critical Resource
Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly. Any unauthorized user having access to the directory can read the sensitive information written into this file. Users are recommended to upgrade to version 4.0.1, which fixes this issue.
- Record
GHSA-c476-j253-5rgq- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-732
- Updated
- 2026-11-02
OSVCLSA-2026-1780966326 No score
TuxCare security update for org.apache.hive:hive-exec (1 CVE)
TuxCare rebuilt org.apache.hive:hive-exec to address 1 CVE. Fixed in 2.3.9-tuxcare.2.
- Record
CLSA-2026-1780966326- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.hive:hive-execMaven |
before 4.0.1 | 4.0.1 |
org.apache.hive:hive-execTuxCare:Maven |
2.3.9 up to 2.3.9-tuxcare.2, plus listed versions 2.3.9.tuxcare.1 |
2.3.9-tuxcare.2 |
org.apache.hive:hive-execMaven |
before 4.0.1, plus listed versions 0.10.00.11.00.12.00.13.00.13.1 Show 36 moreShow less0.14.00.8.00.8.10.9.01.0.01.0.11.1.01.1.11.2.01.2.11.2.22.0.02.0.12.1.02.1.12.2.02.3.02.3.12.3.102.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.93.0.03.1.03.1.13.1.23.1.34.0.04.0.0-alpha-14.0.0-alpha-24.0.0-beta-1 |
4.0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-29869 is a medium vulnerability (CVSS 5.5) in Apache Hive, published January 28, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 22nd percentile. Fixed in org.apache.hive:hive-exec 4.0.1.
References
github.com/apache/hive
issues.apache.org/jira/browse/HIVE-28134
lists.apache.org/thread/h27ohpyrqf9w1m3c0tqr7x8jg59rcrv6
openwall.com/lists/oss-security/2025/01/28/4
nvd.nist.gov/vuln/detail/CVE-2024-29869
repo.maven.apache.org/maven2