CVE-2018-8024: Apache Spark - Exposure of Sensitive Information
Summary
CVE-2018-8024: Exposure of Sensitive Information to an Unauthorized Actor in Apache Spark via crafted URL. Affects org.apache.spark:spark-core_2.10 across 2 version ranges.
>= 2.1.0, < 2.1.3
>= 2.2.0, < 2.2.2
Fixed in 2.1.3 or 2.2.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Spark is a fast and general-purpose cluster computing system. It provides high-level APIs in Java, Scala, Python, and R, and an optimized engine that supports general execution graphs. The vulnerability in Apache Spark allows a malicious user to construct a URL pointing to a Spark cluster's UI's job and stage info pages. If a user is tricked into accessing this URL, it can lead to the execution of malicious scripts and the exposure of sensitive information from the user's view of the Spark UI.
Vulnerability Detail
The vulnerability in Apache Spark arises from the ability of a malicious user to construct a URL that can execute scripts and expose information from the user's view of the Spark UI. This can occur when a user is tricked into accessing a crafted URL pointing to a Spark cluster's UI's job and stage info pages. While some browsers like recent versions of Chrome and Safari can block this type of attack, current versions of Firefox and possibly others do not provide protection. The impact of this vulnerability can be the unauthorized exposure of sensitive information to an attacker.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.1.0, < 2.1.32.1.3 -
>= 2.2.0, < 2.2.22.2.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in Apache Spark allows for the exposure of sensitive information to unauthorized actors. It is recommended to upgrade to the fixed versions of Apache Spark to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.spark:spark-core_2.10 →
FAQ
Apache Spark is a fast and general-purpose cluster computing system.
The impact of this vulnerability is the unauthorized exposure of sensitive information to an attacker.
Versions 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0 are affected.
To fix this vulnerability, upgrade to the fixed versions of Apache Spark: 2.1.3, 2.2.2, or 2.3.1.
No specific workarounds are mentioned for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.spark:spark-core_2.10.
