{ "document": { "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Stackable GmbH and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "product-security@stackable.tech", "issuing_authority": "The Stackable Security Team is responsible for vulnerability handling across all Stackable offerings.", "name": "Stackable GmbH", "namespace": "https://www.stackable.tech/" }, "title": "Stackable Security Advisory for: CVE-2015-1832", "tracking": { "current_release_date": "2026-07-13T16:44:34.494552Z", "generator": { "engine": { "name": "SecObserve", "version": "1.54.0" } }, "id": "CVE-2015-1832", "initial_release_date": "2026-07-13T16:44:34.494552Z", "revision_history": [ { "date": "2026-07-13T16:44:34.494552Z", "number": "1", "summary": "Initial release" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "3.1.3-stackable25.11.0-amd64", "product": { "name": "hive:3.1.3-stackable25.11.0-amd64", "product_id": "pkg:oci/hive@sha256%3Aa8b1a4a9043510d5c5ddb6bd75d5b6167379e93369fd70585063244d0273cedd?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhive", "product_identification_helper": { "purl": "pkg:oci/hive@sha256:a8b1a4a9043510d5c5ddb6bd75d5b6167379e93369fd70585063244d0273cedd?arch=amd64&repository_url=oci.stackable.tech/sdp/hive" } } }, { "category": "product_version", "name": "3.1.3-stackable26.3.0-amd64", "product": { "name": "hive:3.1.3-stackable26.3.0-amd64", "product_id": "pkg:oci/hive@sha256%3A127cfc9a2477d65e8ef484a688f9dbfdac1304e450e5f83e7b99f75e3dc147a2?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhive", "product_identification_helper": { "purl": "pkg:oci/hive@sha256:127cfc9a2477d65e8ef484a688f9dbfdac1304e450e5f83e7b99f75e3dc147a2?arch=amd64&repository_url=oci.stackable.tech/sdp/hive" } } } ], "category": "product_name", "name": "hive" } ], "category": "architecture", "name": "amd64" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "3.1.3-stackable25.11.0-arm64", "product": { "name": "hive:3.1.3-stackable25.11.0-arm64", "product_id": "pkg:oci/hive@sha256%3Aa0046297c6c9ea550cb96c2b7fbd33f2d822c787fefc1dd638234e977597ae10?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhive", "product_identification_helper": { "purl": "pkg:oci/hive@sha256:a0046297c6c9ea550cb96c2b7fbd33f2d822c787fefc1dd638234e977597ae10?arch=arm64&repository_url=oci.stackable.tech/sdp/hive" } } }, { "category": "product_version", "name": "3.1.3-stackable26.3.0-arm64", "product": { "name": "hive:3.1.3-stackable26.3.0-arm64", "product_id": "pkg:oci/hive@sha256%3A970c656bbf69fb2ec5cdd082dd6ea8b55f6cc3292d069fc10e24bac95d3135ea?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhive", "product_identification_helper": { "purl": "pkg:oci/hive@sha256:970c656bbf69fb2ec5cdd082dd6ea8b55f6cc3292d069fc10e24bac95d3135ea?arch=arm64&repository_url=oci.stackable.tech/sdp/hive" } } } ], "category": "product_name", "name": "hive" } ], "category": "architecture", "name": "arm64" } ], "category": "vendor", "name": "Stackable" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "10.10.2.0", "product": { "name": "derby:10.10.2.0", "product_id": "pkg:maven/org.apache.derby/derby@10.10.2.0?type=jar", "product_identification_helper": { "purl": "pkg:maven/org.apache.derby/derby@10.10.2.0?type=jar" } } } ], "category": "product_name", "name": "derby" } ], "category": "vendor", "name": "org.apache.derby" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "pkg:maven/org.apache.derby/derby@10.10.2.0?type=jar@pkg:oci/hive@sha256%3Aa8b1a4a9043510d5c5ddb6bd75d5b6167379e93369fd70585063244d0273cedd?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhive", "product_id": "pkg:maven/org.apache.derby/derby@10.10.2.0?type=jar@pkg:oci/hive@sha256%3Aa8b1a4a9043510d5c5ddb6bd75d5b6167379e93369fd70585063244d0273cedd?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhive" }, "product_reference": "pkg:maven/org.apache.derby/derby@10.10.2.0?type=jar", "relates_to_product_reference": "pkg:oci/hive@sha256%3Aa8b1a4a9043510d5c5ddb6bd75d5b6167379e93369fd70585063244d0273cedd?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhive" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:maven/org.apache.derby/derby@10.10.2.0?type=jar@pkg:oci/hive@sha256%3Aa0046297c6c9ea550cb96c2b7fbd33f2d822c787fefc1dd638234e977597ae10?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhive", "product_id": "pkg:maven/org.apache.derby/derby@10.10.2.0?type=jar@pkg:oci/hive@sha256%3Aa0046297c6c9ea550cb96c2b7fbd33f2d822c787fefc1dd638234e977597ae10?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhive" }, "product_reference": "pkg:maven/org.apache.derby/derby@10.10.2.0?type=jar", "relates_to_product_reference": "pkg:oci/hive@sha256%3Aa0046297c6c9ea550cb96c2b7fbd33f2d822c787fefc1dd638234e977597ae10?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhive" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:maven/org.apache.derby/derby@10.10.2.0?type=jar@pkg:oci/hive@sha256%3A127cfc9a2477d65e8ef484a688f9dbfdac1304e450e5f83e7b99f75e3dc147a2?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhive", "product_id": "pkg:maven/org.apache.derby/derby@10.10.2.0?type=jar@pkg:oci/hive@sha256%3A127cfc9a2477d65e8ef484a688f9dbfdac1304e450e5f83e7b99f75e3dc147a2?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhive" }, "product_reference": "pkg:maven/org.apache.derby/derby@10.10.2.0?type=jar", "relates_to_product_reference": "pkg:oci/hive@sha256%3A127cfc9a2477d65e8ef484a688f9dbfdac1304e450e5f83e7b99f75e3dc147a2?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhive" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:maven/org.apache.derby/derby@10.10.2.0?type=jar@pkg:oci/hive@sha256%3A970c656bbf69fb2ec5cdd082dd6ea8b55f6cc3292d069fc10e24bac95d3135ea?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhive", "product_id": "pkg:maven/org.apache.derby/derby@10.10.2.0?type=jar@pkg:oci/hive@sha256%3A970c656bbf69fb2ec5cdd082dd6ea8b55f6cc3292d069fc10e24bac95d3135ea?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhive" }, "product_reference": "pkg:maven/org.apache.derby/derby@10.10.2.0?type=jar", "relates_to_product_reference": "pkg:oci/hive@sha256%3A970c656bbf69fb2ec5cdd082dd6ea8b55f6cc3292d069fc10e24bac95d3135ea?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhive" } ] }, "vulnerabilities": [ { "cve": "CVE-2015-1832", "flags": [ { "label": "vulnerable_code_not_in_execute_path", "product_ids": [ "pkg:maven/org.apache.derby/derby@10.10.2.0?type=jar@pkg:oci/hive@sha256%3Aa8b1a4a9043510d5c5ddb6bd75d5b6167379e93369fd70585063244d0273cedd?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhive", "pkg:maven/org.apache.derby/derby@10.10.2.0?type=jar@pkg:oci/hive@sha256%3Aa0046297c6c9ea550cb96c2b7fbd33f2d822c787fefc1dd638234e977597ae10?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhive", "pkg:maven/org.apache.derby/derby@10.10.2.0?type=jar@pkg:oci/hive@sha256%3A127cfc9a2477d65e8ef484a688f9dbfdac1304e450e5f83e7b99f75e3dc147a2?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhive", "pkg:maven/org.apache.derby/derby@10.10.2.0?type=jar@pkg:oci/hive@sha256%3A970c656bbf69fb2ec5cdd082dd6ea8b55f6cc3292d069fc10e24bac95d3135ea?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhive" ] } ], "notes": [ { "category": "description", "text": "XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving XmlVTI and the XML datatype.", "title": "Vulnerability description" } ], "product_status": { "known_not_affected": [ "pkg:maven/org.apache.derby/derby@10.10.2.0?type=jar@pkg:oci/hive@sha256%3Aa8b1a4a9043510d5c5ddb6bd75d5b6167379e93369fd70585063244d0273cedd?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhive", "pkg:maven/org.apache.derby/derby@10.10.2.0?type=jar@pkg:oci/hive@sha256%3Aa0046297c6c9ea550cb96c2b7fbd33f2d822c787fefc1dd638234e977597ae10?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhive", "pkg:maven/org.apache.derby/derby@10.10.2.0?type=jar@pkg:oci/hive@sha256%3A127cfc9a2477d65e8ef484a688f9dbfdac1304e450e5f83e7b99f75e3dc147a2?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhive", "pkg:maven/org.apache.derby/derby@10.10.2.0?type=jar@pkg:oci/hive@sha256%3A970c656bbf69fb2ec5cdd082dd6ea8b55f6cc3292d069fc10e24bac95d3135ea?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhive" ] }, "references": [ { "category": "external", "summary": "Security Advisory", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1832" } ], "threats": [ { "category": "impact", "details": "CVE-2015-1832 is an XXE flaw in Apache Derby's SqlXmlUtil, reachable only when the Derby SQL/XML datatype is used, specifically the XMLPARSE and XMLQUERY operators and the XmlVTI table function, against an XML document whose content an attacker controls, and only when no Java Security Manager is installed. Derby ships here purely as the embedded database engine of the Hive standalone metastore (hive-standalone-metastore --> derby 10.10.2.0). The metastore schema uses standard relational types (varchar, int, clob) and never declares an XML column, never calls XMLPARSE, XMLQUERY or XmlVTI, and the Derby XML datatype support additionally requires optional Xalan classes that are not part of the metastore runtime. All SQL against this Derby instance is generated by DataNucleus from a fixed schema. There is no path by which an external actor can submit raw Derby SQL that would invoke the vulnerable SqlXmlUtil code, so the vulnerable code is never in the execute path.", "product_ids": [ "pkg:maven/org.apache.derby/derby@10.10.2.0?type=jar@pkg:oci/hive@sha256%3Aa8b1a4a9043510d5c5ddb6bd75d5b6167379e93369fd70585063244d0273cedd?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhive", "pkg:maven/org.apache.derby/derby@10.10.2.0?type=jar@pkg:oci/hive@sha256%3Aa0046297c6c9ea550cb96c2b7fbd33f2d822c787fefc1dd638234e977597ae10?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhive", "pkg:maven/org.apache.derby/derby@10.10.2.0?type=jar@pkg:oci/hive@sha256%3A127cfc9a2477d65e8ef484a688f9dbfdac1304e450e5f83e7b99f75e3dc147a2?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhive", "pkg:maven/org.apache.derby/derby@10.10.2.0?type=jar@pkg:oci/hive@sha256%3A970c656bbf69fb2ec5cdd082dd6ea8b55f6cc3292d069fc10e24bac95d3135ea?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhive" ] } ], "title": "CVE-2015-1832" } ] }