Log in Start free

Vulnerability · Published Jun 23, 2020 · Assigned by apache

CVE-2020-9480

Critical 9.8

In plain English

A critical-severity security flaw in Apache Spark from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 29.4% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)29.4%top 1.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling2Nuclei, Public PoC

Official description

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.apache.spark:spark-parent_2.112.4.6GHSA-wgx7-jwwm-cgjv
PyPIpyspark2.4.6GHSA-wgx7-jwwm-cgjv
PyPIpyspark2.4.6PYSEC-2020-95

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache Spark Apache Spark 2.4.5 and earlier

References