CVE-2022-41137

Apache HiveMetastore (HMS) usesSerializationUtilities#deserializeObjectWithTypeInformationmethod when filtering and fetching partitions that is unsafe andcan leadto Remote Code Execution (RCE) since it allows the deserialization of arbitrary data.

In real deployments, the vulnerability can be exploited only by authenticated users/clients that were able to successfully establisha connection to the Metastore. From an API perspective any code that calls the unsafe method may be vulnerable unless it performs additional prerechecks on the input arguments.