CVE-2019-20445

CVE-2019-20445 affects Netty’s HttpObjectDecoder: HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header, enabling HTTP request parsing ambiguities. This can enable request-smuggling-like s...

CVE-2020-9480

The CVE-2020-9480 issue affects Apache Spark 2.4.5 and earlier, where a standalone resource manager master configured with spark.authenticate can still be exploited by a crafted RPC to start applications’ resources and run arbitrary shell commands on the host. The vulnerability arises when authen...

CVE-2018-17190

CVE-2018-17190 affects Apache Spark’s standalone resource manager. A specially crafted request can cause the master to execute code on worker nodes, even though the master is not intended to run user code. This vulnerability is described as not affecting standalone clusters with authentication en...

CVE-2023-22946

CVE-2023-22946 affects Apache Spark prior to 3.4.0. An attacker can abuse a proxy-user configuration by placing malicious configuration classes on the classpath, enabling code execution with the privileges of the submitting user (e.g., in environments using Livy). The vulnerability arises when sp...