CVE-2018-1334
Fixed upstream EPSS <1%
In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application.
Products: Apache Software Foundation Apache Spark
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.spark:spark-core_2.10 | 2.1.3 |
| Maven | org.apache.spark:spark-core_2.10 | 2.2.2 |
| Maven | org.apache.spark:spark-core_2.11 | 2.1.3 |
| Maven | org.apache.spark:spark-core_2.11 | 2.2.2 |
| Maven | org.apache.spark:spark-core_2.11 | 2.3.1 |
| PyPI | pyspark | 2.2.2 |
| PyPI | pyspark | 2.1.3 |