GitHub Advisoryadvisory · Maven, PyPI

GHSA-9rr6-jpg7-9jg6 Authentication Bypass by Capture-replay in Apache Spark

HIGH Published 2022-03-11 Modified 2024-10-25 Official page ↗
Aliases
CVE-2021-38296
Ecosystem
Maven, PyPI
Packages
org.apache.spark:spark-core, pyspark
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-294
Reviewed
2022-03-11

Affected packages

• Maven org.apache.spark:spark-core: < 3.1.3 → fixed in 3.1.3 • PyPI pyspark: < 3.1.3 → fixed in 3.1.3

Description

Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would allow someone to decrypt plaintext traffic offline. Note that this does not affect security mechanisms controlled by "spark.authenticate.enableSaslEncryption", "spark.io.encryption.enabled", "spark.ssl", "spark.ui.strictTransportSecurity". Update to Apache Spark 3.1.3 or later

Related

Alias · CVE (1)

  • CVE-2021-38296 Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". vulnerability

Weakness · CWE (1)

  • CWE-294 Authentication Bypass by Capture-replay weakness

References