p PatchFirst

CVE-2017-12612

CVE-2017-12612

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched programmatically using the launcher API potentially vulnerable to arbitrary code execution by an attacker with access to any user account on the local machine. It does not affect apps run by spark-submit or spark-shell. The attacker would be able to execute code as the user that ran the Spark application. Users are encouraged to update to version 2.2.0 or later.

CVSS 8.5 · High · EPSS 0.7% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • org.apache.spark:spark-core_2.11 Maven

    Versions
    • 1.2.0
    • 1.2.1
    • 1.2.2
    • 1.3.0
    • 1.3.1
    • 1.4.0
    • 1.4.1
    • 1.5.0
    • 1.5.1
    • 1.5.2
    • 1.6.0
    • 1.6.1
    • 1.6.2
    • 1.6.3
    • 2.0.0
    • 2.0.0-preview
    • 2.0.1
    • 2.0.2
    • 2.1.0
    • 2.1.1
    Affected ranges
    • ECOSYSTEM: < 2.1.2

    Update to 2.1.2

  • org.apache.spark:spark-core_2.10 Maven

    Versions
    • 0.9.0-incubating
    • 0.9.1
    • 0.9.2
    • 1.0.0
    • 1.0.1
    • 1.0.2
    • 1.1.0
    • 1.1.1
    • 1.2.0
    • 1.2.1
    • 1.2.2
    • 1.3.0
    • 1.3.1
    • 1.4.0
    • 1.4.1
    • 1.5.0
    • 1.5.1
    • 1.5.2
    • 1.6.0
    • 1.6.1
    • 1.6.2
    • 1.6.3
    • 2.0.0
    • 2.0.0-preview
    • 2.0.1
    • 2.0.2
    • 2.1.0
    • 2.1.1
    Affected ranges
    • ECOSYSTEM: < 2.1.2

    Update to 2.1.2

  • pyspark PyPI

    Versions
    • 2.1.1
    Affected ranges
    • ECOSYSTEM: < 2.1.2

    Update to 2.1.2

Original sources

Check your server →