PT-2022-10712 · Apache · Apache Spark

Steve Weis · Published 2022-03-10 · Updated 2024-03-06 · CVE-2021-38296

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Spark versions 3.1.2 and earlier

Description Apache Spark supports end-to-end encryption of RPC connections via spark.authenticate and spark.network.crypto.enabled. In affected versions, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would allow someone to decrypt plaintext traffic offline. Note that this does not affect security mechanisms controlled by spark.authenticate.enableSaslEncryption, spark.io.encryption.enabled, spark.ssl, and spark.ui.strictTransportSecurity.

Recommendations Update to Apache Spark 3.1.3 or later. As a temporary workaround, consider restricting the use of the bespoke mutual authentication protocol until a patch is available. Restrict access to the RPC connections to minimize the risk of exploitation. Avoid using the vulnerable protocol in production environments until the issue is resolved.

Fix

Weakness Enumeration

CWE-294

Related Identifiers

BIT-SPARK-2021-38296

CVE-2021-38296

GHSA-9RR6-JPG7-9JG6

OESA-2022-1591

PYSEC-2022-186

Affected Products

Apache Spark

References · 14

• https://osv.dev/vulnerability/OESA-2022-1591 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9rr6-jpg7-9jg6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-38296 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-spark-2021-38296 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-186 · Vendor Advisory
• https://oracle.com/security-alerts/cpujul2022.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-38296 · Security Note
• https://lists.apache.org/thread/70x8fw2gx3g9ty7yk0f2f1dlpqml2smd · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2022-186.yaml · Note
• https://github.com/advisories/GHSA-9rr6-jpg7-9jg6 · Note
• https://t.me/cibsecurity/38633 · Telegram Post
• https://t.me/cvenotify/43961 · Telegram Post
• https://t.me/cvenotify/28011 · Telegram Post
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1591 · Note