elasticpedia (>=1.0.0, <=1.0.1), ml-hadoop-experiment (0.0.1) +2 more potentially affected by CVE-2022-33891 via pyspark (2.4.4)

pyspark PYPI version 2.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - elasticpedia =1.0.0, =0.1.0, =0.8.4, =0.9.0rc2 Source cves: CVE-2022-33891 Source advisory: OSV:PYSEC-2022-236...

hail (>=0.2.14, <=0.2.64), j11hail (0.2.53) +2 more potentially affected by CVE-2022-33891 via pyspark (2.4.1)

pyspark PYPI version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - hail =0.2.14, =0.1.0, =0.1.0, =0.1.4 Source cves: CVE-2022-33891 Source advisory: OSV:PYSEC-2022-236...

analytics-zoo (0.4.0) potentially affected by CVE-2022-33891 via pyspark (2.3.2)

pyspark PYPI version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - analytics-zoo 0.4.0 Source cves: CVE-2022-33891 Source advisory: OSV:PYSEC-2022-236...

nuna-sql-tools (>=0.0.13, <=0.0.17), pydeequ (0.1.5) +1 more potentially affected by CVE-2022-33891 via pyspark (2.4.7)

pyspark PYPI version 2.4.7 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - nuna-sql-tools =0.0.13, =0.0.17 - pydeequ 0.1.5 - pyrasterframes 0.9.1 Source cves: CVE-2022-33891 Source advisory: OSV:PYSEC-2022-236...

chispa (0.2.0), dye-score (0.1.0) +4 more potentially affected by CVE-2022-33891 via pyspark (2.4.0)

pyspark PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - chispa 0.2.0 - dye-score 0.1.0 - md2k-cerebral-cortex 3.0.0 - pybda =0.0.4, =0.0.4, =0.0.1, =0.0.8 Source cves: CVE-2022-33891 Source advisory:...

Code Injection in uber/petastorm

Description Petastorm is an open source data access library developed at Uber ATG. This library enables single machine or distributed training and evaluation of deep learning models directly from datasets in Apache Parquet format. Petastorm supports popular Python-based machine learning ML...

analytics-zoo (>=0.2.0, <=0.10.0), azureml-webservice-schema (>=0.1.57, <=1.0.33) +31 more potentially affected by CVE-2020-9480 via pyspark (>=2.1.2, <=2.4.5)

pyspark PYPI version =2.1.2, =0.2.0, =0.1.57, =0.11.0, =0.1.2, =0.1.0, =1.0.0, =0.8.0, =0.2.1, =0.2.64 - intake-hive 0.1.0 - j11hail 0.2.53 - md2k-cerebral-cortex 3.0.0 - ml-hadoop-experiment 0.0.1 - mlops-cloud 0.1.0 and more Source cves: CVE-2020-9480 Source advisory: MEND:CVE-2020-9480...

PySpark Interface Privilege Escalation

The vulnerability of the PySpark framework of Apache Spark is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

Security Bulletin: Multiple Vulnerabilities in Apache Spark affects IBM Watson Studio Local

Summary Security Bulletin: Multiple Vulnerabilities in Apache Spark affects IBM Watson Studio Local Vulnerability Details CVEID: CVE-2018-11804 DESCRIPTION: Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation. ...

Security Bulletin: IBM Cloud Private for Data is affected by a user impersonation vulnerability in PySpark.

Summary When using Open Source Apache PySpark, it’s possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. This affects versions 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1. Vulnerability Details CVE-ID:...

GHSA-FP5J-3FPF-MHJ5 Sensitive data written to disk unencrypted in Spark

Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk controlled by spark.maxRemoteBlockSizeFetchToMem; in SparkR, using parallelize; in Pyspark, using...

PYSEC-2019-114

Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk controlled by spark.maxRemoteBlockSizeFetchToMem; in SparkR, using parallelize; in Pyspark, using...

Code injection

Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk controlled by spark.maxRemoteBlockSizeFetchToMem; in SparkR, using parallelize; in Pyspark, using...

PYSEC-2019-114

Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk controlled by spark.maxRemoteBlockSizeFetchToMem; in SparkR, using parallelize; in Pyspark, using...

CVE-2019-10099

Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk controlled by spark.maxRemoteBlockSizeFetchToMem; in SparkR, using parallelize; in Pyspark, using...

CVE-2019-10099

Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk controlled by spark.maxRemoteBlockSizeFetchToMem; in SparkR, using parallelize; in Pyspark, using...

PT-2019-20133

Name of the Vulnerable Software and Affected Versions Apache Spark versions prior to 2.3.3 Description The issue arises when Apache Spark writes user data to local disk unencrypted, despite having spark.io.encryption.enabled set to true. This occurs in specific situations, including when cached...

CVE-2019-10099: Cleartext Storage of Sensitive Information

Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk controlled by spark.maxRemoteBlockSizeFetchToMem; in SparkR, using parallelize; in Pyspark, using...

PT-2019-11428

Name of the Vulnerable Software and Affected Versions: Apache Spark versions prior to 2.3.3 Description: The issue allows user data to be written to local disk unencrypted, despite having spark.io.encryption.enabled set to true. This occurs in specific situations, including when cached blocks are...

Security Bulletin: Vulnerability in PySpark affects IBM Analytics Engine (CVE-2018-11760)

Summary When using PySpark, it’s possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. This affects versions 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1. Vulnerability Details CVE-ID: CVE-2018-11760 DESCRIPTION:...