CVE-2016-9177

CVE-2016-9177 affects Spark 2.5 (path traversal vulnerability in static file serving). The root cause is directory traversal protection not preventing a .. in the URI, allowing an attacker to read arbitrary server files. Documented impact includes potential exposure of sensitive data. Mitigation ...

CVE-2018-9159

CVE-2018-9159 affects Spark before 2.7.2, allowing a remote attacker to disclose unintended static files via absolute/relative path representations (including file: URLs and directory traversal). The issue is addressed by Spark 2.7.2 and upstream fixes cited by Red Hat and SUSE OSV/RH advisories;...