Vulnerability · Published Mar 10, 2022 · Assigned by apache

CVE-2021-38296Apache Spark Key Negotiation Vulnerability

High 7.5

In plain English

A high-severity security flaw in Apache Spark from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.5High

Exploit odds (30 days)1.8%top 20.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would allow someone to decrypt plaintext traffic offline. Note that this does not affect security mechanisms controlled by "spark.authenticate.enableSaslEncryption", "spark.io.encryption.enabled", "spark.ssl", "spark.ui.strictTransportSecurity". Update to Apache Spark 3.1.3 or later

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.apache.spark:spark-core	3.1.3	GHSA-9rr6-jpg7-9jg6
PyPI	pyspark	3.1.3	GHSA-9rr6-jpg7-9jg6
PyPI	pyspark	3.1.3	PYSEC-2022-186

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache Spark	up to and including version 3.1.2 – through 3.1.2

Weakness: CWE-294

References

https://lists.apache.org/thread/70x8fw2gx3g9ty7yk0f2f1dlpqml2smd x_refsource_MISC
https://www.oracle.com/security-alerts/cpujul2022.html x_refsource_MISC