Advisoriesby IbisApache SparkGHSA-fvxv-9xxr-h7wj
Pyspark User Impersonation Vulnerability
Fix: upgrade to 2.2.3 or later (2 fixed versions below)
When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. This affects versions 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| pyspark PyPI | >= 2.3.0, < 2.3.2 | 2.3.2 |
| >= 1.0.2, < 2.2.3 | 2.2.3 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- Severity from
- GitHub (reviewed advisory)
- Also known as
- CVE-2018-11760, PYSEC-2019-169
- nvd.nist.gov/vuln/detail/CVE-2018-11760
- github.com/advisories/GHSA-fvxv-9xxr-h7wj
- github.com/apache/spark
- github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2019-169.yaml
- lists.apache.org/thread.html/6d015e56b3a3da968f86e0b6acc69f17ecc16b499389e12d8255bf6e@%3Ccommits.spark.apache.org%3E
- lists.apache.org/thread.html/a86ee93d07b6f61b82b61a28049aed311f5cc9420d26cc95f1a9de7b@%3Cuser.spark.apache.org%3E
- web.archive.org/web/20200227091119/http://www.securityfocus.com/bid/106786
- web.archive.org/web/20200925111106/https://issues.apache.org/jira/browse/SPARK-26802
More Apache Spark advisories
All Apache Spark
Apache Spark UI can allow impersonation if ACLs enabledCVE-2022-33891fixed in 3.1.3 +1Authentication Bypass by Capture-replay in Apache SparkCVE-2021-38296fixed in 3.1.3Improper Authentication in Apache SparkCVE-2020-9480fixed in 2.4.6Sensitive data written to disk unencrypted in SparkCVE-2019-10099fixed in 2.3.3Exposure of Sensitive Information to an Unauthorized Actor in Apache SparkCVE-2018-1334fixed in 2.1.3 +1Apache Spark Deserialization of Untrusted Data vulnerabilityCVE-2017-12612fixed in 2.1.2