Arbitrary Code Execution Vulnerability in Apache Spark by Apache
CVE-2017-12612

7.8HIGH

Key Information:

Vendor
Apache
Status
Spark
Vendor
CVE Published:
13 September 2017

Summary

In specific versions of Apache Spark, the launcher API exhibits unsafe data deserialization through its socket connections. This flaw could allow attackers with access to any user account on the local machine to execute arbitrary code, leading to serious security implications. Notably, this vulnerability does not impact applications executed via spark-submit or spark-shell. Users are strongly advised to upgrade to Apache Spark version 2.2.0 or higher to mitigate this risk.

References

http://www.securityfocus.com/bid/100823
vdb-entryx_refsource_BID
https://mail-archives.apache.org/mod_mbox/spark-dev/20170...
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.