GitHub Advisoryadvisory · PyPI
GHSA-fvxv-9xxr-h7wj Pyspark User Impersonation Vulnerability
MEDIUM
Official page ↗
- Aliases
- CVE-2018-11760
- Ecosystem
- PyPI
- Packages
- pyspark
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- Reviewed
- 2020-06-16
Affected packages
• PyPI pyspark: >= 2.3.0, < 2.3.2 → fixed in 2.3.2
• PyPI pyspark: >= 1.0.2, < 2.2.3 → fixed in 2.2.3
Description
When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. This affects versions 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1.
Related
Alias · CVE (1)
- CVE-2018-11760 When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the… vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-11760 advisory
- https://github.com/advisories/GHSA-fvxv-9xxr-h7wj advisory
- https://github.com/apache/spark web
- https://github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2019-169.yaml web
- https://lists.apache.org/thread.html/6d015e56b3a3da968f86e0b6acc69f17ecc16b499389e12d8255bf6e@%3Ccommits.spark.apache.org%3E web
- https://lists.apache.org/thread.html/a86ee93d07b6f61b82b61a28049aed311f5cc9420d26cc95f1a9de7b@%3Cuser.spark.apache.org%3E web
- https://web.archive.org/web/20200227091119/http://www.securityfocus.com/bid/106786 web
- https://web.archive.org/web/20200925111106/https://issues.apache.org/jira/browse/SPARK-26802 web