CVE-2020-9480: Critical severity apache spark vulnerability
In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-9480?
CVE-2020-9480 is a vulnerability in Apache Spark 2.4.5 and earlier, which allows a specially-crafted RPC to start an application's resources on the Spark cluster, even when authentication is enabled.
How severe is CVE-2020-9480?
CVE-2020-9480 has a severity rating of 9.8 (critical).
What software is affected by CVE-2020-9480?
Apache Spark 2.4.5 and earlier versions, as well as Oracle Business Intelligence 5.5.0.0.0, are affected by CVE-2020-9480.
How can I fix CVE-2020-9480?
To fix CVE-2020-9480, update Apache Spark to version 3.0.0 or later, or apply the recommended patches provided by Oracle for Oracle Business Intelligence.
What is the Common Weakness Enumeration (CWE) ID for CVE-2020-9480?
The CWE ID for CVE-2020-9480 is CWE-306.