PT-2018-3338 · Apache · Apache Spark

Published

2018-11-18

·

Updated

2020-08-24

·

CVE-2018-17190

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: Apache Spark versions prior to a version with authentication enabled for standalone clusters
Description: The issue is related to the standalone resource manager in Apache Spark, which can execute user code on 'worker' hosts but is not designed to execute code on the 'master' host itself. However, a specially-crafted request can cause the master to execute code, potentially affecting the confidentiality, integrity, and availability of protected information. This issue does not affect standalone clusters with authentication enabled.
Recommendations: For Apache Spark versions prior to a version with authentication enabled for standalone clusters: Enable authentication on any Spark standalone cluster that is not otherwise secured from unwanted access, for example by network-level restrictions. Use spark.authenticate and related security properties as described in the official Apache Spark security documentation.

Fix

Improper Authentication

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

BDU:2020-00063
CVE-2018-17190
GHSA-PHG2-9C5G-M4Q7

Affected Products

Apache Spark