PT-2026-25061 · Apache · Apache Ivy+1

Furue Hideyuki · Publicado 2026-03-12 · Atualizado 2026-03-14 · CVE-2025-60012

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Apache Livy versions 0.7.0 and 0.8.0

Description A malicious configuration can lead to unauthorized file access in Apache Livy. This issue occurs when connecting to Apache Spark 3.1 or later. A request including a Spark configuration value supported from Apache Spark version 3.1 can allow users to gain access to files they are not permitted to access. Exploitation requires access to the Apache Livy REST or JDBC interface and the ability to send requests with arbitrary Spark configuration values. The vulnerable component is the Spark configuration processing logic within Apache Livy.

Recommendations Upgrade to version 0.9.0 or later to resolve this issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2025-60012

GHSA-HM8X-RPGG-7855

Produtos afetados

Apache Ivy

Apache Spark

Referências · 10

• https://github.com/apache/incubator-livy · Nota
• https://osv.dev/vulnerability/GHSA-hm8x-rpgg-7855 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2025-60012 · Aviso do Fabricante
• https://twitter.com/oss_security/status/2032147522211213428 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2032831379713720574 · Publicação no Twitter
• https://lists.apache.org/thread/gpc85fwrgrbglpk9gm8tmcjzqnctx64w · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-60012 · Nota de Segurança
• https://twitter.com/the_yellow_fall/status/2032271616814518726 · Publicação no Twitter
• http://openwall.com/lists/oss-security/2026/03/12/1 · Nota
• https://twitter.com/cyberbivash/status/2032541056084963343 · Publicação no Twitter