CVE Feed

    Dashboard / CVE / CVE-2021-38296

    CVE-2021-38296

    Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would allow someone to decrypt plaintext traffic offline. Note that this does not affect security mechanisms controlled by "spark.authenticate.enableSaslEncryption", "spark.io.encryption.enabled", "spark.ssl", "spark.ui.strictTransportSecurity". Update to Apache Spark 3.1.3 or later

    Published:Mar 10, 2022
    Last Modified:Nov 21, 2024
    EPS:Mar 10, 2022
    EPSS Score:0.0088
    CVSS Score:7.5

    Affected Products

    Vendor
    Apache
    Product
    Spark
    Vendor
    Oracle
    Product
    Financial Services Crime And Compliance Management Studio

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-32773 (CVSS 6.1) — There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job …
    CVE-2025-54920 (CVSS 8.8) — This issue affects Apache Spark: before 3.5.7 and 4.0.1. Users are recommended to upgrade to version 3.5.7 or …
    CVE-2025-55039 (CVSS 6.5) — This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0. Apache Spark versions before 4.0.0…
    CVE-2024-23945 (CVSS 5.9) — Signing cookies is an application security feature that adds a digital signature to cookie data to verify its …
    CVE-2023-32007 (CVSS 8.8) — ** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuratio…
    CVE-2023-22946 (CVSS 6.4) — In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as,…
    CVE-2022-31777 (CVSS 5.4) — A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote …
    CVE-2022-33891 (CVSS 8.8) — The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With…
    CVE-2020-27223 (CVSS 5.2) — In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a requ…
    CVE-2020-27218 (CVSS 4.8) — In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High