PT-2019-11428 · Apache · Apache Spark
Publicado
2019-08-07
·
Atualizado
2022-04-22
·
CVE-2019-10099
CVSS v4.0
8.7
Alta
| Vetor | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions:
Apache Spark versions prior to 2.3.3
Description:
The issue allows user data to be written to local disk unencrypted, despite having spark.io.encryption.enabled set to true. This occurs in specific situations, including when cached blocks are fetched to disk, and when using certain functions in SparkR and Pyspark, such as parallelize, broadcast, and python udfs.
Recommendations:
For versions prior to 2.3.3, update to version 2.3.3 or later to resolve the issue. As a temporary workaround, consider disabling the use of
spark.maxRemoteBlockSizeFetchToMem and avoiding the use of parallelize and broadcast functions in SparkR and Pyspark until a patch is available. Restrict access to python udfs to minimize the risk of exploitation.Correção
Cleartext Storage of Sensitive Information
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Apache Spark