CVE-2018-1334: Infoleak
Published Jul 12, 2018
·Updated
In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application.
Affected Software
8 affected componentsFixes available
Apache Spark<=2.1.2
Apache Spark>=2.2.0<=2.2.1
Apache Spark=2.3.0
pip/pyspark>=0<2.1.3
2.1.3
pip/pyspark>=2.2.0<2.2.2
2.2.2
maven/org.apache.spark:spark-core_2.11=2.3.0
2.3.1
maven/org.apache.spark:spark-core_2.11>=2.2.0<2.2.2
2.2.2
maven/org.apache.spark:spark-core_2.11>=1.0.0<2.1.3
2.1.3
Event History
Jul 12, 2018
CVE Published
via MITRE·01:00 PM
Data Sourced
via MITRE·01:00 PM
DescriptionWeakness
Mar 14, 2019
Advisory Published
via GitHub·03:41 PM
Frequently Asked Questions
1
What is the severity of CVE-2018-1334?
CVE-2018-1334 has been classified as a moderate severity vulnerability.
2
How do I fix CVE-2018-1334?
To fix CVE-2018-1334, upgrade Apache Spark to versions 2.1.3, 2.2.2, or 2.3.1 depending on your current version.
3
What versions of Apache Spark are affected by CVE-2018-1334?
CVE-2018-1334 affects Apache Spark versions from 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and also 2.3.0.
4
What type of attack does CVE-2018-1334 expose my Spark application to?
CVE-2018-1334 allows a local user to connect and impersonate the user running the Spark application.
5
Is CVE-2018-1334 specific to any programming languages?
CVE-2018-1334 is specifically noted for vulnerabilities when using PySpark or SparkR.