Описание
Exposure of Sensitive Information to an Unauthorized Actor in Apache Spark
In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2018-1334
- https://github.com/advisories/GHSA-6mqq-8r44-vmjc
- https://github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2018-25.yaml
- https://lists.apache.org/thread.html/4d6d210e319a501b740293daaeeeadb51927111fb8261a3e4cd60060@%3Cdev.spark.apache.org%3E
- https://spark.apache.org/security.html#CVE-2018-1334
Пакеты
org.apache.spark:spark-core_2.10
>= 1.0.0, < 2.1.3
2.1.3
org.apache.spark:spark-core_2.10
>= 2.2.0, < 2.2.2
2.2.2
org.apache.spark:spark-core_2.11
>= 1.0.0, < 2.1.3
2.1.3
org.apache.spark:spark-core_2.11
>= 2.2.0, < 2.2.2
2.2.2
org.apache.spark:spark-core_2.11
= 2.3.0
2.3.1
pyspark
>= 2.2.0, < 2.2.2
2.2.2
pyspark
< 2.1.3
2.1.3
Связанные уязвимости
In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application.
In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using ...