PT-2018-11764 · Apache · Apache Spark

Nehmã© Tohmã© · Published 2018-07-12 · Updated 2019-03-14 · CVE-2018-1334

Positive Technologies (AI Summary)

CVSS v4.0

6.0

Medium

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Spark versions 1.0.0 through 2.1.2 Apache Spark versions 2.2.0 through 2.2.1 Apache Spark version 2.3.0

Description The issue allows a different local user to connect to the Spark application and impersonate the user running the application when using PySpark or SparkR.

Recommendations For Apache Spark versions 1.0.0 through 2.1.2, update to a version outside of this range to resolve the issue. For Apache Spark versions 2.2.0 through 2.2.1, update to a version outside of this range to resolve the issue. For Apache Spark version 2.3.0, update to a version later than 2.3.0 to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-1334

GHSA-6MQQ-8R44-VMJC

PYSEC-2018-25

Affected Products

Apache Spark

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2018-1334 · Security Note
• https://spark.apache.org/security.html#CVE-2018-1334 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2018-25 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1334 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6mqq-8r44-vmjc · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2018-25.yaml · Note
• https://github.com/advisories/GHSA-6mqq-8r44-vmjc · Note
• https://lists.apache.org/thread.html/4d6d210e319a501b740293daaeeeadb51927111fb8261a3e4cd60060%40%3Cdev.spark.apache.org%3E · Note
• https://lists.apache.org/thread.html/4d6d210e319a501b740293daaeeeadb51927111fb8261a3e4cd60060@%3Cdev.spark.apache.org%3E · Note