CVE-2018-1334

In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application.

Score

CVSS 3.0 4.7 Medium

Status

Modified - security@apache.org

Published

2018-07-12

Last modified

2024-09-17

Weaknesses

CWE-200

Affected products

• Spark (Apache)
• Apache Spark (Apache Software Foundation)

References

• https://lists.apache.org/thread.html/4d6d210e319a501b740293daaeeeadb51927111fb8261a3e4cd60060%40%3Cdev.spark.apache.org…
• https://spark.apache.org/security.html#CVE-2018-1334