GHSA-fvxv-9xxr-h7wj

Pyspark User Impersonation Vulnerability

En bref

Publiée: 2019-02-07 18:02 UTC
Mise à jour: 2024-12-04 05:31 UTC
CVE: CVE-2018-11760
Alias: PYSEC-2019-169
CVSS_V3: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS_V4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Description

When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. This affects versions 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1.

Paquets affectés

Paquet	Versions
PyPI · pyspark	introduced 2.3.0, fixed 2.3.2
PyPI · pyspark	introduced 1.0.2, fixed 2.2.3

Références

https://nvd.nist.gov/vuln/detail/CVE-2018-11760 ADVISORY
https://github.com/advisories/GHSA-fvxv-9xxr-h7wj ADVISORY
https://github.com/apache/spark WEB
https://github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2019-169.yaml WEB
https://lists.apache.org/thread.html/6d015e56b3a3da968f86e0b6acc69f17ecc16b499389e12d8255bf6e@%3Ccommits.spark.apache.org%3E WEB
https://lists.apache.org/thread.html/a86ee93d07b6f61b82b61a28049aed311f5cc9420d26cc95f1a9de7b@%3Cuser.spark.apache.org%3E WEB
https://web.archive.org/web/20200227091119/http://www.securityfocus.com/bid/106786 WEB
https://web.archive.org/web/20200925111106/https://issues.apache.org/jira/browse/SPARK-26802 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database