Skip to content
Apache SparkGHSA-8rhc-48pp-52gr

Apache Spark Deserialization of Untrusted Data vulnerability

High7.8CVE-2017-12612 · Published Nov 9, 2018 · updated Nov 26, 2024

GitHub advisory

Affected versions

PackageAffectedFixed in
pyspark
PyPI
< 2.1.22.1.2
Details and references

In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched programmatically using the launcher API potentially vulnerable to arbitrary code execution by an attacker with access to any user account on the local machine. It does not affect apps run by spark-submit or spark-shell. The attacker would be able to execute code as the user that ran the Spark application. Users are encouraged to update to version 2.1.2, 2.2.0 or later.

CVSS 3.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-502
Also known as
CVE-2017-12612, PYSEC-2017-147

More Apache Spark advisories

All Apache Spark
DateAdvisory
Feb 72019Pyspark User Impersonation Vulnerability
CVE-2018-11760Medium5.5fixed in 2.2.3, 2.3.2
Mar 142019Exposure of Sensitive Information to an Unauthorized Actor in Apache Spark
CVE-2018-1334Medium4.7fixed in 2.1.3, 2.2.2
Aug 82019Sensitive data written to disk unencrypted in Spark
CVE-2019-10099High7.5fixed in 2.3.3
Feb 102022Improper Authentication in Apache Spark
CVE-2020-9480Critical9.8fixed in 2.4.6
Mar 112022Authentication Bypass by Capture-replay in Apache Spark
CVE-2021-38296High7.5fixed in 3.1.3
Jul 192022Apache Spark UI can allow impersonation if ACLs enabled
CVE-2022-33891High8.8fixed in 3.1.3, 3.2.2

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.