GHSA-wgx7-jwwm-cgjv

Source

https://github.com/advisories/GHSA-wgx7-jwwm-cgjv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-wgx7-jwwm-cgjv/GHSA-wgx7-jwwm-cgjv.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-wgx7-jwwm-cgjv

Aliases

Published

2022-02-10T23:05:20Z

Modified

2024-10-15T16:40:37.173246Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Improper Authentication in Apache Spark

Details

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).

Database specific

{
    "nvd_published_at": "2020-06-23T22:15:00Z",
    "cwe_ids": [
        "CWE-287",
        "CWE-306"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-11T21:39:30Z"
}

References

Affected packages

Maven / org.apache.spark:spark-parent_2.11

Package

Name: org.apache.spark:spark-parent_2.11; View open source insights on deps.dev
Purl: pkg:maven/org.apache.spark/spark-parent_2.11

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.6

Affected versions

1.*

1.3.0

1.3.1

1.4.0

1.4.1

1.5.0

1.5.1

1.5.2

1.6.0

1.6.1

1.6.2

1.6.3

2.*

2.0.0

2.0.0-preview

2.0.1

2.0.2

2.1.0

2.1.1

2.1.2

2.1.3

2.2.0

2.2.1

2.2.2

2.2.3

2.3.0

2.3.1

2.3.2

2.3.3

2.3.4

2.4.0

2.4.1

2.4.2

2.4.3

2.4.4

2.4.5

Database specific

{
    "last_known_affected_version_range": "<= 2.4.5"
}

PyPI / pyspark