Apache SparkGHSA-wgx7-jwwm-cgjv
Improper Authentication in Apache Spark
Critical9.8CVE-2020-9480 · Published Feb 10, 2022 · updated Oct 15, 2024
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| pyspark PyPI | < 2.4.6 | 2.4.6 |
Details and references
In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-287, CWE-306
- Also known as
- BIT-spark-2020-9480, CVE-2020-9480, PYSEC-2020-95
- nvd.nist.gov/vuln/detail/CVE-2020-9480
- github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2020-95.yaml
- lists.apache.org/thread.html/r03ad9fe7c07d6039fba9f2152d345274473cb0af3d8a4794a6645f4b@%3Cuser.spark.apache.org%3E
- lists.apache.org/thread.html/ra0e62a18ad080c4ce6df5e0202a27eaada75222761efc3f7238b5a3b@%3Ccommits.doris.apache.org%3E
- lists.apache.org/thread.html/rb3956440747e41940d552d377d50b144b60085e7ff727adb0e575d8d@%3Ccommits.submarine.apache.org%3E
- lists.apache.org/thread.html/ree9e87aae81852330290a478692e36ea6db47a52a694545c7d66e3e2@%3Cdev.spark.apache.org%3E
- spark.apache.org/security.html#CVE-2020-9480
- www.oracle.com/security-alerts/cpuApr2021.html
More Apache Spark advisories
All Apache Spark| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 112022 | Authentication Bypass by Capture-replay in Apache Spark CVE-2021-38296High7.5fixed in 3.1.3 | High7.5 | 3.1.3 |
| Jul 192022 | Apache Spark UI can allow impersonation if ACLs enabled CVE-2022-33891High8.8fixed in 3.1.3, 3.2.2 | High8.8 | 3.1.3, 3.2.2 |
| Nov 12022 | Apache Spark vulnerable to Log Injection CVE-2022-31777Medium5.4fixed in 3.2.2, 3.3.1 | Medium5.4 | 3.2.2, 3.3.1 |
| Apr 172023 | Apache Spark vulnerable to Improper Privilege Management CVE-2023-22946Critical9.9fixed in 3.3.2, 3.3.3 | Critical9.9 | 3.3.2, 3.3.3 |
| May 22023 | Apache Spark UI vulnerable to Command Injection CVE-2023-32007High8.8fixed in 3.2.2 | High8.8 | 3.2.2 |
| Aug 82019 | Sensitive data written to disk unencrypted in Spark CVE-2019-10099High7.5fixed in 2.3.3 | High7.5 | 2.3.3 |