CVE-2018-11760

Published: Feb 4, 2019Modified: Nov 21, 2024

5.5

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. This affects versions 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1.

Affected (5)

Products: Apache: Spark

Apache

1 product

Spark

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Apache Spark	From 1.0.2 to 1.6.3
Apache Spark	From 2.0.0 to 2.0.2
Apache Spark	From 2.1.0 to 2.1.3
Apache Spark	From 2.2.0 to 2.2.2
Apache Spark	From 2.3.0 to 2.3.1

References (6)

http://www.securityfocus.com/bid/106786

Source: security@apache.org

Third Party Advisory

https://lists.apache.org/thread.html/6d015e56b3a3da968f86e0b6acc69f17ecc16b499389e12d8255bf6e%40%3Ccommits.spark.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/a86ee93d07b6f61b82b61a28049aed311f5cc9420d26cc95f1a9de7b%40%3Cuser.spark.apache.org%3E

Source: security@apache.org

http://www.securityfocus.com/bid/106786

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://lists.apache.org/thread.html/6d015e56b3a3da968f86e0b6acc69f17ecc16b499389e12d8255bf6e%40%3Ccommits.spark.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/a86ee93d07b6f61b82b61a28049aed311f5cc9420d26cc95f1a9de7b%40%3Cuser.spark.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.