CVE-2018-11804: Improper Input Validation in Apache Spark
Summary
CVE-2018-11804: Improper Input Validation in Apache Spark. Affects org.apache.spark:spark-core versions >= 1.3.0, <= 2.1.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Spark is an open-source distributed computing system used for big data processing and analytics. It provides a programming model and an execution engine that supports a wide range of applications. The 'spark-core' package is a fundamental component of Spark, providing core functionality and APIs for distributed computing. This vulnerability affects developers building Spark from source code, specifically in the Apache Maven-based build process.
Vulnerability Detail
The vulnerability in Apache Spark arises from an improper input validation issue in the 'build/mvn' convenience script used for compiling the code. This script includes a zinc server that speeds up compilation. By default, the zinc server accepts connections from external hosts. An attacker can exploit this by sending a specially-crafted request to the zinc server, potentially leading to the disclosure of sensitive information in files accessible to the developer account running the build. It is important to note that this vulnerability does not impact end users of Spark, but only developers building Spark from source code.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, developers can minimize the risk by ensuring the zinc server is not exposed to external hosts or by implementing additional access controls to restrict connections to trusted sources only.
Conclusion
The vulnerability in Apache Spark's build process can potentially expose sensitive information to attackers. Developers building Spark from source code should ensure they are using a patched version of Spark and follow secure build practices. It is recommended to regularly check for updates and apply patches to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for org.apache.spark:spark-core →
FAQ
This vulnerability only affects developers building Apache Spark from source code using the Apache Maven-based build process. End users of Spark are not impacted.
If exploited, this vulnerability could allow an attacker to access sensitive information in files readable to the developer account running the build process. However, it does not impact the security of Spark deployments for end users.
There are no known instances of this vulnerability being exploited in the wild. However, it is recommended to apply the necessary patches and follow secure build practices to mitigate the risk.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file for analysis.
For more information about this vulnerability, you can refer to the GitHub Advisory Database entry at: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-62g2-m955-v383/GHSA-62g2-m955-v383.json
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.spark:spark-core.
