PT-2018-3338 · Apache · Apache Spark
Published
2018-11-18
·
Updated
2020-08-24
·
CVE-2018-17190
CVSS v3.1
10
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Apache Spark versions prior to a version with authentication enabled for standalone clusters
Description:
The issue is related to the standalone resource manager in Apache Spark, which can execute user code on 'worker' hosts but is not designed to execute code on the 'master' host itself. However, a specially-crafted request can cause the master to execute code, potentially affecting the confidentiality, integrity, and availability of protected information. This issue does not affect standalone clusters with authentication enabled.
Recommendations:
For Apache Spark versions prior to a version with authentication enabled for standalone clusters:
Enable authentication on any Spark standalone cluster that is not otherwise secured from unwanted access, for example by network-level restrictions.
Use spark.authenticate and related security properties as described in the official Apache Spark security documentation.
Fix
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apache Spark