OESA-2022-1591 spark security update

Apache Spark achieves high performance for both batch and streaming data, using a state-of-the-art DAG scheduler, a query optimizer, and a physical execution engine. Security Fixes: Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and...

abi-ds-utils (>=0.1.2, <=0.1.9), abi-pyspark-utils (>=0.1.1, <=0.1.4) +68 more potentially affected by CVE-2021-38296 via pyspark (>=3.0.0, <=3.1.2)

pyspark PYPI version =3.0.0, =0.1.2, =0.1.1, =0.5.1, =1.0.0, =0.12.0.dev0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =1.0.0, =1.0.0, =1.0.1 - cehrbert 1.5.0 and more Source cves: CVE-2021-38296 Source advisory: GHSA-9RR6-JPG7-9JG6...

analytics-zoo (0.2.0), hail (>=0.2.1, <=0.2.12) potentially affected by CVE-2021-38296 via pyspark (2.2.3)

pyspark PYPI version 2.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - analytics-zoo 0.2.0 - hail =0.2.1, =0.2.12 Source cves: CVE-2021-38296 Source advisory: OSV:GHSA-9RR6-JPG7-9JG6...

abi-ds-utils (>=0.1.2, <=0.1.9), abi-pyspark-utils (>=0.1.1, <=0.1.4) +68 more potentially affected by CVE-2021-38296 via pyspark (>=3.0.0, <=3.1.2)

pyspark PYPI version =3.0.0, =0.1.2, =0.1.1, =0.5.1, =1.0.0, =0.12.0.dev0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =1.0.0, =1.0.0, =1.0.1 - cehrbert 1.5.0 and more Source cves: CVE-2021-38296 Source advisory: OSV:GHSA-9RR6-JPG7-9JG6...

azureml-webservice-schema (>=0.1.57, <=1.0.33), mmtfpyspark (0.2.7) +1 more potentially affected by CVE-2021-38296 via pyspark (2.3.1)

pyspark PYPI version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - azureml-webservice-schema =0.1.57, =2.0.3, =2.1.1 Source cves: CVE-2021-38296 Source advisory: OSV:GHSA-9RR6-JPG7-9JG6...

analytics-zoo (0.4.0) potentially affected by CVE-2021-38296 via pyspark (2.3.2)

pyspark PYPI version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - analytics-zoo 0.4.0 Source cves: CVE-2021-38296 Source advisory: OSV:GHSA-9RR6-JPG7-9JG6...

pytispark (2.0.0) potentially affected by CVE-2021-38296 via pyspark (2.3.3)

pyspark PYPI version 2.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - pytispark 2.0.0 Source cves: CVE-2021-38296 Source advisory: OSV:GHSA-9RR6-JPG7-9JG6...

intake-hive (0.1.0), sparklanes (>=0.2.0, <=0.2.4) potentially affected by CVE-2021-38296 via pyspark (2.3.0)

pyspark PYPI version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - intake-hive 0.1.0 - sparklanes =0.2.0, =0.2.4 Source cves: CVE-2021-38296 Source advisory: OSV:PYSEC-2022-186...

nuna-sql-tools (>=0.0.13, <=0.0.17), pydeequ (0.1.5) +1 more potentially affected by CVE-2021-38296 via pyspark (2.4.7)

pyspark PYPI version 2.4.7 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - nuna-sql-tools =0.0.13, =0.0.17 - pydeequ 0.1.5 - pyrasterframes 0.9.1 Source cves: CVE-2021-38296 Source advisory: OSV:PYSEC-2022-186...

abi-ds-utils (>=0.1.2, <=0.1.9), abi-pyspark-utils (>=0.1.1, <=0.1.4) +68 more potentially affected by CVE-2021-38296 via pyspark (>=3.0.0, <=3.1.2)

pyspark PYPI version =3.0.0, =0.1.2, =0.1.1, =0.5.1, =1.0.0, =0.12.0.dev0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =1.0.0, =1.0.0, =1.0.1 - cehrbert 1.5.0 and more Source cves: CVE-2021-38296 Source advisory: OSV:PYSEC-2022-186...

analytics-zoo (>=0.11.0, <=0.12.0b2022082301), bigdl (>=0.13.0.dev1, <=2.5.0b20240324) +12 more potentially affected by CVE-2021-38296 via pyspark (2.4.6)

pyspark PYPI version 2.4.6 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - analytics-zoo =0.11.0, =0.13.0.dev1, =0.14.0b20211027, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =1.0.0, =0.3.0, =0.2.1, =0.4.1 Source cves:...

abi-ds-utils (>=0.1.2, <=0.1.9), abi-pyspark-utils (>=0.1.1, <=0.1.4) +118 more potentially affected by CVE-2021-38296 via pyspark (>=2.1.2, <=3.1.2)

pyspark PYPI version =2.1.2, =0.1.2, =0.1.1, =0.5.1, =0.2.0, =1.0.0, =0.9.1, =0.1.57, =0.11.0, =0.14.0b20211027, =2.0.0, =2.5.0b20240324 and more Source cves: CVE-2021-38296 Source advisory: MEND:CVE-2021-38296...

CVE-2021-38296

CVE-2021-38296 affects Apache Spark where versions up to 3.1.2 use a bespoke mutual authentication protocol for end-to-end RPC encryption that can enable full encryption key recovery and offline decryption of plaintext traffic. The issue is limited to Spark’s key exchange/authentication path and ...