CVE-2018-1334
CVE-2018-1334
This page contains facts from public vulnerability sources. Check the original advisory before updating.
In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application.
CVSS 6.0 · Medium · EPSS 0.5% · Fix available
- Published
- Updated
Stack: python
Affected products and versions
apache spark
- Versions
- 1.0.0 to 2.1.2: Affected
- 2.2.0 to 2.2.1: Affected
- 2.3.0: Affected
No fix published
org.apache.spark:spark-core_2.10 Maven
- Versions
- 1.0.0
- 1.0.1
- 1.0.2
- 1.1.0
- 1.1.1
- 1.2.0
- 1.2.1
- 1.2.2
- 1.3.0
- 1.3.1
- 1.4.0
- 1.4.1
- 1.5.0
- 1.5.1
- 1.5.2
- 1.6.0
- 1.6.1
- 1.6.2
- 1.6.3
- 2.0.0
- 2.0.0-preview
- 2.0.1
- 2.0.2
- 2.1.0
- 2.1.1
- 2.1.2
- Affected ranges
- ECOSYSTEM: ≥ 1.0.0, < 2.1.3
Update to 2.1.3
org.apache.spark:spark-core_2.10 Maven
- Versions
- 2.2.0
- 2.2.1
- Affected ranges
- ECOSYSTEM: ≥ 2.2.0, < 2.2.2
Update to 2.2.2
org.apache.spark:spark-core_2.11 Maven
- Versions
- 1.2.0
- 1.2.1
- 1.2.2
- 1.3.0
- 1.3.1
- 1.4.0
- 1.4.1
- 1.5.0
- 1.5.1
- 1.5.2
- 1.6.0
- 1.6.1
- 1.6.2
- 1.6.3
- 2.0.0
- 2.0.0-preview
- 2.0.1
- 2.0.2
- 2.1.0
- 2.1.1
- 2.1.2
- Affected ranges
- ECOSYSTEM: ≥ 1.0.0, < 2.1.3
Update to 2.1.3
org.apache.spark:spark-core_2.11 Maven
- Versions
- 2.2.0
- 2.2.1
- Affected ranges
- ECOSYSTEM: ≥ 2.2.0, < 2.2.2
Update to 2.2.2
org.apache.spark:spark-core_2.11 Maven
- Versions
- 2.3.0
- Affected ranges
- ECOSYSTEM: ≥ 2.3.0, < 2.3.1
Update to 2.3.1
pyspark PyPI
- Versions
- 2.2.0
- 2.2.1
- Affected ranges
- ECOSYSTEM: ≥ 2.2.0, < 2.2.2
Update to 2.2.2
pyspark PyPI
- Versions
- 2.1.1
- 2.1.2
- Affected ranges
- ECOSYSTEM: < 2.1.3
Update to 2.1.3
pyspark PyPI
- Versions
- 2.1.1
- 2.1.2
- 2.2.0
- 2.2.1
- Affected ranges
- ECOSYSTEM: ≥ 2.2.0, < 2.2.2 ∪ < 2.1.3
Update to 2.2.2; Update to 2.1.3