CVE-2019-10099: High severity apache spark vulnerability
Published Aug 7, 2019
·Updated
Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk (controlled by spark.maxRemoteBlockSizeFetchToMem); in SparkR, using parallelize; in Pyspark, using broadcast and parallelize; and use of python udfs.
Affected Software
7 affected componentsFixes available
Apache Spark>=1.0.2<=1.6.3
Apache Spark>=2.0.0<=2.0.2
Apache Spark>=2.1.0<=2.1.3
Apache Spark>=2.2.0<=2.2.2
Apache Spark>=2.3.0<2.3.2
pip/pyspark>=0<2.3.3
2.3.3
maven/org.apache.spark:spark-core_2.11<2.3.3
2.3.3
Remediation
Event History
Aug 7, 2019
CVE Published
via MITRE·04:18 PM
Data Sourced
via MITRE·04:18 PM
DescriptionWeakness
Aug 8, 2019
Advisory Published
via GitHub·03:18 PM
Frequently Asked Questions
1
What is the severity of CVE-2019-10099?
The severity of CVE-2019-10099 is rated as high with a score of 7.5.
2
How can I mitigate the impact of CVE-2019-10099?
To mitigate CVE-2019-10099, users should upgrade to Spark version 2.3.3 or higher where the vulnerability has been fixed.
3
Which versions of Apache Spark are affected by CVE-2019-10099?
CVE-2019-10099 affects Apache Spark versions ranging from 1.0.2 to 2.3.2.
4
What type of vulnerability is CVE-2019-10099?
CVE-2019-10099 is classified under CWE-312, which is related to cleartext storage of sensitive information vulnerability.