PT-2017-12600 · Apache · Apache Spark

Publicado 2017-09-13 · Atualizado 2018-11-09 · CVE-2017-12612

Positive Technologies (AI Summary)

CVSS v4.0

8.5

Alta

Vetor base

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Spark versions 1.6.0 through 2.1.1

Description The launcher API in Apache Spark performs unsafe deserialization of data received by its socket, making applications launched programmatically using the launcher API potentially vulnerable to arbitrary code execution by an attacker with access to any user account on the local machine. This issue does not affect applications run by spark-submit or spark-shell. The attacker would be able to execute code as the user that ran the Spark application.

Recommendations For Apache Spark versions 1.6.0 through 2.1.1, update to version 2.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the launcher API to minimize the risk of exploitation.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2017-12612

GHSA-8RHC-48PP-52GR

PYSEC-2017-147

Produtos afetados

Apache Spark

Referências · 7

• https://github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2017-147.yaml · Nota
• https://osv.dev/vulnerability/GHSA-8rhc-48pp-52gr · Aviso do Fabricante
• http://securityfocus.com/bid/100823 · Nota
• https://mail-archives.apache.org/mod_mbox/spark-dev/201709.mbox/%3CCAEccTyy-1yYuhdNgkBUg0sr9NeaZSrBKkBePdTNZbxXZNTAR-g%40mail.gmail.com%3E · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2017-147 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-12612 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-12612 · Aviso do Fabricante