PT-2018-10829 · Apache · Apache Spark

Andre Protas · Published 2018-10-24 · Updated 2024-06-10 · CVE-2018-11804

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Spark versions 1.3.x through master

Description The issue concerns a convenience script in Apache Spark's Apache Maven-based build that downloads and runs a zinc server to speed up compilation. This server accepts connections from external hosts by default. A specially-crafted request to the zinc server could cause it to reveal information in files readable to the developer account running the build. Note that this issue does not affect end users of Spark, only developers building Spark from source code.

Recommendations For versions 1.3.x through master, consider disabling the zinc server or restricting its access to prevent external connections until a patch is available. As a temporary workaround, restrict access to the build/mvn script to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-11804

GHSA-62G2-M955-V383

Affected Products

Apache Spark

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2018-11804 · Security Note
• https://osv.dev/vulnerability/GHSA-62g2-m955-v383 · Vendor Advisory
• https://spark.apache.org/security.html#CVE-2018-11804 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-11804 · Vendor Advisory
• https://github.com/apache/spark · Note
• https://lists.apache.org/thread.html/2b11aa4201e36f2ec8f728e722fe33758410f07784379cbefd0bda9d%40%3Cdev.spark.apache.org%3E · Note
• https://web.archive.org/web/20200227103903/http://securityfocus.com/bid/105756 · Note
• http://securityfocus.com/bid/105756 · Note
• https://lists.apache.org/thread.html/2b11aa4201e36f2ec8f728e722fe33758410f07784379cbefd0bda9d@%3Cdev.spark.apache.org%3E · Note
• https://t.me/cvenotify/82647 · Telegram Post
• https://t.me/cvenotify/38211 · Telegram Post