GHSA-fvxv-9xxr-h7wj

Pyspark User Impersonation Vulnerability

At a glance

Published: 2019-02-07 18:02 UTC
Updated: 2024-12-04 05:31 UTC
CVE: CVE-2018-11760
Aliases: PYSEC-2019-169
CVSS_V3: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS_V4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Description

When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. This affects versions 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1.

Affected packages

Package	Versions
PyPI · pyspark	introduced 2.3.0, fixed 2.3.2
PyPI · pyspark	introduced 1.0.2, fixed 2.2.3

References

https://nvd.nist.gov/vuln/detail/CVE-2018-11760 ADVISORY
https://github.com/advisories/GHSA-fvxv-9xxr-h7wj ADVISORY
https://github.com/apache/spark WEB
https://github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2019-169.yaml WEB
https://lists.apache.org/thread.html/6d015e56b3a3da968f86e0b6acc69f17ecc16b499389e12d8255bf6e@%3Ccommits.spark.apache.org%3E WEB
https://lists.apache.org/thread.html/a86ee93d07b6f61b82b61a28049aed311f5cc9420d26cc95f1a9de7b@%3Cuser.spark.apache.org%3E WEB
https://web.archive.org/web/20200227091119/http://www.securityfocus.com/bid/106786 WEB
https://web.archive.org/web/20200925111106/https://issues.apache.org/jira/browse/SPARK-26802 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database