GHSA-fp5j-3fpf-mhj5

    Dashboard / Vulnerabilities / GHSA-fp5j-3fpf-mhj5

    GHSA-fp5j-3fpf-mhj5

    Published: 8 Aug 2019Last Modified: 24 Oct 2024

    Summary: Sensitive data written to disk unencrypted in Spark

    Details: Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk (controlled by spark.maxRemoteBlockSizeFetchToMem); in SparkR, using parallelize; in Pyspark, using broadcast and parallelize; and use of python udfs.

    References: https://nvd.nist.gov/vuln/detail/CVE-2019-10099, https://github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2019-114.yaml, https://lists.apache.org/thread.html/c2a39c207421797f82823a8aff488dcd332d9544038307bf69a2ba9e@%3Cuser.spark.apache.org%3E, https://lists.apache.org/thread.html/ra216b7b0dd82a2c12c2df9d6095e689eb3f3d28164e6b6587da69fae@%3Ccommits.spark.apache.org%3E, https://lists.apache.org/thread.html/rabe1d47e2bf8b8f6d9f3068c8d2679731d57fa73b3a7ed1fa82406d2@%3Cissues.spark.apache.org%3E

    Affected packages

    Package

    Name: org.apache.spark:spark-core_2.11

    Purl: pkg:maven/org.apache.spark/spark-core_2.11

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.3.3

    Affected versions

    1.2.0
    1.2.1
    1.2.2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High