Executive brief
org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11 Improper Authentication vulnerability
Affected products
- Maven org.apache.spark:spark-core_2.10
- Maven org.apache.spark:spark-core_2.11
Junglewise Threat Intelligence
CVE-2018-11770: org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11 Improper Authentication vulnerability
CVE-2018-11770 · Severity: low · CVSS 3.1 · Published 2018-11-09
Technologies: org.apache.spark:spark-core_2.10 (Maven), org.apache.spark:spark-core_2.11 (Maven). Vendors: Maven.
Related threats
- Improper Input Validation in Apache Spark
- PYSEC-2019-114 - Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true.
- Remote Code Execution in spark-core
- Moderate severity vulnerability that affects org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11
- PYSEC-2017-147 - In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications