In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it’s possible for a different local user to connect to the Spark application and impersonate the user running the Spark application.
[
{
"product": "Apache Spark",
"vendor": "Apache Software Foundation",
"versions": [
{
"status": "affected",
"version": "1.0.0 to 2.1.2"
},
{
"status": "affected",
"version": "2.2.0 to 2.2.1"
},
{
"status": "affected",
"version": "2.3.0"
}
]
}
]