net.sansa-stack:sansa-examples-spark_2.12 (=0.8.0-RC3), net.sansa-stack:sansa-inference-spark_2.12 (=0.8.0-RC3) +4 more potentially affected by CVE-2022-28890 via org.apache.jena:jena (=4.4.0)

org.apache.jena:jena MAVEN version =4.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.jena:jena and may be impacted: - net.sansa-stack:sansa-examples-spark2.12 =0.8.0-RC3 - net.sansa-stack:sansa-inference-spark2.12 =0.8.0-RC3 -...

ai.catboost:catboost-spark_2.11 (>=0.25-rc1 <=0.25-rc3), ai.catboost:catboost-spark_2.12 (>=0.25-rc1 <=0.25-rc3) +4643 more potentially affected by CVE-2007-5614 via org.mortbay.jetty:jetty (>=6.0.0 <=6.1.5rc0)

org.mortbay.jetty:jetty MAVEN version =6.0.0, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =0.6.0, =3.20.0.2, =3.20.0.2, =3.20.0.2, =3.20.0.2, =3.8.3.3, =3.42.0.4 and more Source cves: CVE-2007-5614 Source advisory: OSV:GHSA-FVH3-4V5R-CVVC...

ai.catboost:catboost-spark_2.11 (>=0.25-rc1 <=0.25-rc3), ai.catboost:catboost-spark_2.12 (>=0.25-rc1 <=0.25-rc3) +4643 more potentially affected by CVE-2007-5613 via org.mortbay.jetty:jetty (>=6.0.0 <=6.1.5rc0)

org.mortbay.jetty:jetty MAVEN version =6.0.0, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =0.6.0, =3.20.0.2, =3.20.0.2, =3.20.0.2, =3.20.0.2, =3.8.3.3, =3.42.0.4 and more Source cves: CVE-2007-5613 Source advisory: OSV:GHSA-8H77-9VH5-HW5G...

Check Point Response to CVE-2022-21449 - Java "Psychic Signatures"

Symptoms - On April 20, 2022, security researcher Neil Madden published a blog post in which he provided details about a newly disclosed vulnerability in Java, CVE-2022-21449 or "Psychic Signatures". This security vulnerability originates in an incorrect implementation of the ECDSA signature...

ai.catboost:catboost-spark_3.2_2.12 (>=1.0.6 <=1.2.10), ai.catboost:catboost-spark_3.2_2.13 (>=1.0.6 <=1.2.10) +647 more potentially affected by CVE-2022-26612 via org.apache.hadoop:hadoop-common (>=3.3.0 <=3.3.2)

org.apache.hadoop:hadoop-common MAVEN version =3.3.0, =1.0.6, =1.0.6, =1.1, =1.1.1, =0.13.0, =0.2.7, =0.2.7, =0.6.1.2, =1.0.0, =1.0.0, =0.2.2, =1.0.0, =1.0.0, =0.2.2, =0.4.1 and more Source cves: CVE-2022-26612 Source advisory: OSV:GHSA-GX2C-FVHC-PH4J...

OESA-2022-1591 spark security update

Apache Spark achieves high performance for both batch and streaming data, using a state-of-the-art DAG scheduler, a query optimizer, and a physical execution engine. Security Fixes: Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and...

Information Disclosure

org.apache.spark:spark-hive-thriftserver2.12 is vulnerable to information disclosure. The vulnerability allows someone to decrypt plaintext traffic offline because the library uses a bespoke mutual authentication protocol that allows for full encryption key recovery resulting in disclosure of...

Authentication Bypass by Capture-replay in Apache Spark

Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would...

GHSA-9RR6-JPG7-9JG6 Authentication Bypass by Capture-replay in Apache Spark

Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would...

Apache Spark Encryption Problem Vulnerability (CNVD-2022-21823)

Apache Spark is a multilingual engine for performing data engineering, data science, and machine learning on a single-node machine or cluster. Apache Spark is vulnerable to an encryption issue that stems from the program's use of a custom mutual authentication protocol that allows fully encrypted...

CVE-2021-38296

Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would...

CVE-2021-38296

Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would...

Authentication flaw

Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would...

PYSEC-2022-186

Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would...

PYSEC-2022-186

Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would...

CVE-2021-38296

CVE-2021-38296 affects Apache Spark where versions up to 3.1.2 use a bespoke mutual authentication protocol for end-to-end RPC encryption that can enable full encryption key recovery and offline decryption of plaintext traffic. The issue is limited to Spark’s key exchange/authentication path and ...

CVE-2021-38296 Apache Spark Key Negotiation Vulnerability

Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would...

PT-2022-10712 · Apache · Apache Spark

Name of the Vulnerable Software and Affected Versions: Apache Spark versions 3.1.2 and earlier Description: Apache Spark supports end-to-end encryption of RPC connections via spark.authenticate and spark.network.crypto.enabled. In affected versions, it uses a bespoke mutual authentication protoco...

Apache Spark 加密问题漏洞

Apache Spark is a multilingual engine for performing data engineering, data science, and machine learning on a single-node machine or cluster. Apache Spark is vulnerable to an encryption issue that stems from the program's use of a custom mutual authentication protocol that allows fully encrypted...

Improper Authentication in Apache Spark

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication spark.authenticate via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even...