CVE-2018-1334

Published: Jul 12, 2018Modified: Nov 21, 2024

4.7

Vector

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability: 1.0 / Impact: 3.6

Source: NVD

Description

In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application.

Affected (3)

Products: Apache: Spark

Apache

1 product

Spark

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Apache Spark	Up to 2.1.2
Apache Spark	From 2.2.0 to 2.2.1
Apache Spark	Version 2.3.0

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (4)

https://lists.apache.org/thread.html/4d6d210e319a501b740293daaeeeadb51927111fb8261a3e4cd60060%40%3Cdev.spark.apache.org%3E

Source: security@apache.org

https://spark.apache.org/security.html#CVE-2018-1334

Source: security@apache.org

MitigationVendor Advisory

https://lists.apache.org/thread.html/4d6d210e319a501b740293daaeeeadb51927111fb8261a3e4cd60060%40%3Cdev.spark.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://spark.apache.org/security.html#CVE-2018-1334

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationVendor Advisory

Timeline

No history available yet.