GHSA-89GC-6CW6-4VCH Spark allows remote attackers to read arbitrary files via a .. (dot dot) in the URI

Directory traversal vulnerability in Spark 2.5 allows remote attackers to read arbitrary files via a .. dot dot in the URI...

CVE-2018-1330 vulnerabilities

Vulnerabilities for packages: spark...

Apache Spark < 2.1.3 / 2.2.x < 2.2.2 / 2.3.x < 2.3.1 XSS in UI

The remote web server is running a version of Apache Spark that is affected by a Cross-Site Scripting XSS vulnerability due to a flaw in Spark cluster's UI's job and stage info pages, which allows a remote attacker to use specially crafted requests that can lead to arbitrary HTML and script code...

SUSE-SU-2018:2689-1 Security update for spark

This update for spark fixes the following security issue: - CVE-2018-9159: Fix a security problem in the serving of static files. bsc1087837...

Apache Spark Authentication Control Vulnerability

Apache Spark is a large-scale data processing engine that supports acyclic data streams and in-memory computing from the Apache Software Foundation. A security vulnerability exists in Apache Spark versions 1.3.0 and later, which is caused by a standalone master or a Mesos master with cluster mode...

Critical: Red Hat Security Advisory: Red Hat FIS 2.0 on Fuse 6.3.0 R7 security and bug fix update

An update is now available for Red Hat Fuse Integration Services. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

spark: Absolute and relative pathnames allow for unintended static file disclosure

In Spark before 2.7.2, a remote attacker can read unintended static files via various representations of absolute or relative pathnames, as demonstrated by file: URLs and directory traversal sequences. NOTE: this product is unrelated to Ignite Realtime Spark...

Exposed API

Apache's spark contains an exposed API due to the default value of spark.master.rest.enabled being set to true. This allows remote attackers to connect to the API without authentication and run driver programs but not launch executors...

CVE-2018-11770

From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs vi...

Authentication flaw

From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs vi...

CVE-2018-11770

From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs vi...

CVE-2018-11770

From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs vi...

CVE-2018-11770

From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs vi...

CVE-2018-11770

CVE-2018-11770 affects Apache Spark 1.3.0+ where the standalone master exposes a REST API for job submission that bypasses the configured spark.authenticate.secret. The REST API does not require authentication and, per multiple sources, could allow a user to run a driver program without authentic...

PT-2018-10814

Name of the Vulnerable Software and Affected Versions Apache Spark versions 1.3.0 and later Description The issue concerns Apache Spark's standalone master, which exposes a REST API for job submission without using any authentication mechanism, unlike the submission mechanism used by spark-submit...

CVE-2018-11770

From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs vi...

CVE-2018-11770: Improper Authentication

From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs vi...

The first Spark REST API is not authorized to exploit analysis-exploit warning-the black bar safety net

2018 7 on 7 May, Ali Cloud Security for the first time to capture the Spark REST API unauthorized RCE vulnerability to attack of real samples. 7 on number 9 plays, Ali Cloud Platform has been able to the default of Defense the vulnerability of the large-scale use. This is the first time in...

Apache Spark Cross-Site Scripting Vulnerability (CNVD-2018-15536)

Apache Spark is a large-scale data processing engine that supports acyclic data streams and in-memory computing from the Apache Software Foundation. A cross-site scripting vulnerability exists in the UI of Apache Spark versions 1.0.0 through 2.1.2, 2.2.0 through 2.2.1, and 2.3.0. A remote attacke...

Apache Spark Spoofing Vulnerability

Apache Spark is a large-scale data processing engine that supports acyclic data streaming and in-memory computation. Apache Spark versions 1.0.0 through 2.1.2, 2.2.0 through 2.2.1, and 2.3.0 have a spoofing vulnerability in the implementation. When running PySpark and SparkR, a local attacker can...