PT-2017-12600 · Apache · Apache Spark

Published 2017-09-13 · Updated 2018-11-09 · CVE-2017-12612

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Spark versions 1.6.0 through 2.1.1

Description The launcher API in Apache Spark performs unsafe deserialization of data received by its socket, making applications launched programmatically using the launcher API potentially vulnerable to arbitrary code execution by an attacker with access to any user account on the local machine. This issue does not affect applications run by spark-submit or spark-shell. The attacker would be able to execute code as the user that ran the Spark application.

Recommendations For Apache Spark versions 1.6.0 through 2.1.1, update to version 2.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the launcher API to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2017-12612

GHSA-8RHC-48PP-52GR

PYSEC-2017-147

Affected Products

Apache Spark

References · 7

• https://osv.dev/vulnerability/GHSA-8rhc-48pp-52gr · Vendor Advisory
• https://mail-archives.apache.org/mod_mbox/spark-dev/201709.mbox/%3CCAEccTyy-1yYuhdNgkBUg0sr9NeaZSrBKkBePdTNZbxXZNTAR-g%40mail.gmail.com%3E · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2017-147 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12612 · Security Note
• https://osv.dev/vulnerability/CVE-2017-12612 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2017-147.yaml · Note
• http://securityfocus.com/bid/100823 · Note