p PatchFirst

PatchFirst · Latest vulnerabilities

org.apache.spark:spark-parent_2.11 vulnerabilities

Vulnerabilities published for org.apache.spark:spark-parent_2.11 in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerability: 1

  1. CVE-2020-9480

    Critical · CVSS 9.8EPSS 29.37%Public exploitFix available

    CVE-2020-9480

    In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).

    org.apache.spark:spark-parent_2.11
    • Update to 2.4.6
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →