Apache Spark

3 results · Clear filters · Feed

• High 8.8
  CVE-2022-33891 Exploited Public exploit EPSS 93%

  Apache Spark shell command injection vulnerability via Spark UI

  The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in H…

  Apache Software Foundation Apache Spark pyspark org.apache.spark:spark-parent_2.12 Maven PyPI
  Jul 18, 2022

  KEV Mar 7, 2023
• Critical 9.8
  CVE-2020-9480 Public exploit EPSS 30%

  Improper Authentication in Apache Spark

  In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application…

  Apache Software Foundation Apache Spark pyspark org.apache.spark:spark-parent_2.11 Maven PyPI
  Jun 23, 2020
• Medium 4.2
  CVE-2018-11770 Public exploit EPSS 66%

  org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11 Improper Authentication vulnerability

  From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for aut…

  Apache Software Foundation Apache Spark org.apache.spark:spark-core_2.11 org.apache.spark:spark-core_2.10 Maven
  Aug 13, 2018