GitHub Advisoryadvisory · Maven, PyPI

GHSA-wgx7-jwwm-cgjv Improper Authentication in Apache Spark

CRITICAL Published 2022-02-10 Modified 2024-10-15 Official page ↗
Aliases
CVE-2020-9480
Ecosystem
Maven, PyPI
Packages
org.apache.spark:spark-parent_2.11, pyspark
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287, CWE-306
Reviewed
2021-05-11

Affected packages

• Maven org.apache.spark:spark-parent_2.11: < 2.4.6 → fixed in 2.4.6 • PyPI pyspark: < 2.4.6 → fixed in 2.4.6

Description

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).

Related

Alias · CVE (1)

  • CVE-2020-9480 In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate)… vulnerability

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-306 Missing Authentication for Critical Functionality weakness

References