CVE-2018-11770

CVE-2018-11770 affects Apache Spark 1.3.0+ where the standalone master exposes a REST API for job submission that bypasses the configured spark.authenticate.secret. The REST API does not require authentication and, per multiple sources, could allow a user to run a driver program without authentic...

CVE-2018-11804

CVE-2018-11804 – Information disclosure in Spark Maven build zinc server : The vulnerability stems from a zinc server started by the Maven-based Spark build (build/mvn) which, by default, accepts connections from external hosts. A specially crafted request to the zinc server can cause it to revea...