PT-2018-11764 · Apache · Apache Spark

Nehmã© Tohmã© · Publicado 2018-07-12 · Atualizado 2019-03-14 · CVE-2018-1334

Positive Technologies (AI Summary)

CVSS v4.0

6.0

Média

Vetor base

AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Spark versions 1.0.0 through 2.1.2 Apache Spark versions 2.2.0 through 2.2.1 Apache Spark version 2.3.0

Description The issue allows a different local user to connect to the Spark application and impersonate the user running the application when using PySpark or SparkR.

Recommendations For Apache Spark versions 1.0.0 through 2.1.2, update to a version outside of this range to resolve the issue. For Apache Spark versions 2.2.0 through 2.2.1, update to a version outside of this range to resolve the issue. For Apache Spark version 2.3.0, update to a version later than 2.3.0 to resolve the issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2018-1334

GHSA-6MQQ-8R44-VMJC

PYSEC-2018-25

Produtos afetados

Apache Spark

Referências · 9

• https://github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2018-25.yaml · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1334 · Nota de Segurança
• https://github.com/advisories/GHSA-6mqq-8r44-vmjc · Nota
• https://spark.apache.org/security.html#CVE-2018-1334 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2018-25 · Aviso do Fabricante
• https://lists.apache.org/thread.html/4d6d210e319a501b740293daaeeeadb51927111fb8261a3e4cd60060%40%3Cdev.spark.apache.org%3E · Nota
• https://lists.apache.org/thread.html/4d6d210e319a501b740293daaeeeadb51927111fb8261a3e4cd60060@%3Cdev.spark.apache.org%3E · Nota
• https://osv.dev/vulnerability/CVE-2018-1334 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-6mqq-8r44-vmjc · Aviso do Fabricante