CVE-2018-1334

4.7MEDIUM

Key Information:

Vendor
Apache
Status
Apache Spark
Vendor
CVE Published:
12 July 2018

Summary

In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application.

Affected Version(s)

Apache Spark 1.0.0 to 2.1.2

Apache Spark 2.2.0 to 2.2.1

Apache Spark 2.3.0

References

https://spark.apache.org/security.html#CVE-2018-1334
x_refsource_CONFIRM
https://lists.apache.org/thread.html/4d6d210e319a501b7402...
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.