CVE-2018-11760

When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. This affects versions 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1...

CVE-2018-11760

When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. This affects versions 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1...

CVE-2018-11760

CVE-2018-11760 describes a PySpark-related local privilege issue in Apache Spark: a local authenticated user can connect to a running Spark application and impersonate the user running it. Affected Spark versions include 1.x, 2.0.x, 2.1.x, 2.2.0–2.2.2, and 2.3.0–2.3.1. IBM and related advisories ...

CVE-2018-11760: Undefined Security Weakness

When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. This affects versions 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1...

Privilege Escalation

PySpark is vulnerable to privilege escalation. A local user is able to connect to the spark application and impersonate the user running the Spark application...

PT-2019-4410

Name of the Vulnerable Software and Affected Versions Apache Spark versions 1.x, 2.0.x, 2.1.x, 2.2.0 through 2.2.2, 2.3.0 through 2.3.1 Description The issue is related to insufficient access control in the PySpark interface of the Apache Spark framework. This can allow an attacker to elevate the...

Apache Spark Spoofing Vulnerability

Apache Spark is a large-scale data processing engine that supports acyclic data streaming and in-memory computation. Apache Spark versions 1.0.0 through 2.1.2, 2.2.0 through 2.2.1, and 2.3.0 have a spoofing vulnerability in the implementation. When running PySpark and SparkR, a local attacker can...

Code injection

In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application...

CVE-2018-1334

In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application...

eskapade-spark (>=0.8.0, <=0.8.2), pytispark (>=1.0.0rc2, <=1.0.1) potentially affected by CVE-2018-1334 via pyspark (2.1.2)

pyspark PYPI version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - eskapade-spark =0.8.0, =1.0.0rc2, =1.0.1 Source cves: CVE-2018-1334 Source advisory: OSV:PYSEC-2018-25...

sourced-ml (0.4.5) potentially affected by CVE-2018-1334 via pyspark (2.2.0.post0)

pyspark PYPI version 2.2.0.post0 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - sourced-ml 0.4.5 Source cves: CVE-2018-1334 Source advisory: OSV:PYSEC-2018-25...

PYSEC-2018-25

In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application...

PYSEC-2018-25

In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application...

eskapade-spark (>=0.8.0, <=0.8.2), pytispark (>=1.0.0rc2, <=1.0.1) potentially affected by CVE-2018-1334 via pyspark (2.1.2)

pyspark PYPI version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - eskapade-spark =0.8.0, =1.0.0rc2, =1.0.1 Source cves: CVE-2018-1334 Source advisory: MEND:CVE-2018-1334...

sourced-ml (0.4.5) potentially affected by CVE-2018-1334 via pyspark (2.2.0.post0)

pyspark PYPI version 2.2.0.post0 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - sourced-ml 0.4.5 Source cves: CVE-2018-1334 Source advisory: MEND:CVE-2018-1334...

CVE-2018-1334

In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application...

CVE-2018-1334

Apache Spark up to version 2.3.0 (affected: 1.0.0–2.1.2, 2.2.0–2.2.1, 2.3.0) is vulnerable to an impersonation flaw when using PySpark or SparkR that lets a different local user connect to a Spark application and impersonate the Spark user. The issue is confirmed across multiple sources (e.g., SU...

CVE-2018-1334

In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application...

PT-2018-11764

Name of the Vulnerable Software and Affected Versions Apache Spark versions 1.0.0 through 2.1.2 Apache Spark versions 2.2.0 through 2.2.1 Apache Spark version 2.3.0 Description The issue allows a different local user to connect to the Spark application and impersonate the user running the...

CVE-2018-1334: Exposure of Sensitive Information to an Unauthorized Actor

In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application...