Apache Spark - Authentication Bypass

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication spark.authenticate via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even...

CVE-2020-9480

CVE-2020-9480...

CVE-2020-9480

creationtimestamp| type| source ---|---|--- 2025-08-15 16:40:05+00:00| seen| https://t.me/truesecator/7335 2025-10-01 21:02:26+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3m25wrr2t7b23...

Apache Spark Remote Code Execution (CVE-2020-9480)

A remote code execution vulnerability exists in Apache Spark. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

CVE-2020-9480

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication spark.authenticate via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Apache Spark

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Apache Spark. Vulnerability Details CVEID: CVE-2020-9480 DESCRIPTION: Apache Spark could allow a remote attacker to execute arbitrary commands on the system, caused by a flaw when authentication is enabled on...

Security Bulletin: A vulnerability in Apache Spark 2.4.5 and earlier affects IBM Operations Analytics Predictive Insights (CVE-2020-9480)

Summary Apache Spark is used by IBM Operations Analytics Predictive Insights. IBM Operations Analytics Predictive Insights has addressed the applicable CVE. See the Remediation/Fixes section and apply the recommended fixes. Vulnerability Details CVEID: CVE-2020-9480 DESCRIPTION: Apache Spark coul...

CVE-2020-9480

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication spark.authenticate via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even...

CVE-2020-9480

A remote code execution vulnerability exists in Apache Spark 2.4.5 and earlier when using a standalone resource manager. Although the master may be configured to require authentication via a shared secret (spark.authenticate), a specially-crafted RPC can bypass this check to start application res...

analytics-zoo (>=0.2.0, <=0.10.0), azureml-webservice-schema (>=0.1.57, <=1.0.33) +31 more potentially affected by CVE-2020-9480 via pyspark (>=2.1.2, <=2.4.5)

pyspark PYPI version =2.1.2, =0.2.0, =0.1.57, =0.11.0, =0.1.2, =0.1.0, =1.0.0, =0.8.0, =0.2.1, =0.2.64 - intake-hive 0.1.0 - j11hail 0.2.53 - md2k-cerebral-cortex 3.0.0 - ml-hadoop-experiment 0.0.1 - mlops-cloud 0.1.0 and more Source cves: CVE-2020-9480 Source advisory: MEND:CVE-2020-9480...