Data Exposure Vulnerability in Apache Spark by Apache Software Foundation
CVE-2019-10099

7.5HIGH

Key Information:

Vendor

Apache
Status
Apache Spark
Vendor
CVE Published:
7 August 2019

What is CVE-2019-10099?

Prior to version 2.3.3, Apache Spark had a vulnerability where user data could be unintentionally written to local disk in an unencrypted format, even when encryption settings were enabled. This issue affected various functionalities including cached blocks fetched to disk, operations in SparkR using parallelize, and broadcast and parallelize in PySpark. It posed a security risk by potentially exposing sensitive user data stored on local systems.

Affected Version(s)

Apache Spark 2.3.2 and below

References

https://lists.apache.org/thread.html/c2a39c207421797f8282...
x_refsource_MISC
https://lists.apache.org/thread.html/rabe1d47e2bf8b8f6d9f...
mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/ra216b7b0dd82a2c12c2...
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.