CVE-2018-1334: Apache Spark PySpark Impersonation Vulnerability
Summary
CVE-2018-1334: In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application... Affects pyspark across 2 version ranges.
< 2.1.3
>= 2.2.0, < 2.2.2
Fixed in 2.1.3 or 2.2.2, depending on the release line you run. How to fix ↓
Also tracked for
- org.apache.spark:spark-core_2.10 · Maven
The same CVE-2018-1334 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Spark is an open-source distributed computing system used for big data processing and analytics. PySpark is the Python API for Apache Spark, allowing users to write Spark applications using Python. This vulnerability affects versions 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0 of Apache Spark when using PySpark or SparkR. It allows a different local user to connect to the Spark application and impersonate the user running the Spark application.
Vulnerability Detail
The vulnerability arises due to a flaw in the PySpark and SparkR components of Apache Spark. It enables an unauthorized local user to establish a connection to the Spark application and assume the identity of the user executing the application. This impersonation can lead to unauthorized access to sensitive data, privilege escalation, and potential misuse of the Spark application's resources.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.1.32.1.3pip install --upgrade "pyspark==2.1.3" -
>= 2.2.0, < 2.2.22.2.2pip install --upgrade "pyspark==2.2.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that only trusted local users have access to the Spark application and its resources. Additionally, monitoring and auditing the Spark application's activity can help detect any unauthorized access or impersonation attempts.
Conclusion
The Apache Spark PySpark Impersonation Vulnerability allows a local user to connect to a Spark application and impersonate the user running the application. This can lead to unauthorized access, privilege escalation, and misuse of resources. It is crucial to upgrade to the patched version of Apache Spark or use versions 2.1.3 or later to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for pyspark →
FAQ
Apache Spark is an open-source distributed computing system used for big data processing and analytics. It provides an interface for programming entire clusters with implicit data parallelism and fault tolerance.
PySpark is the Python API for Apache Spark. It allows users to write Spark applications using Python, leveraging the power of Spark's distributed computing capabilities.
SparkR is the R API for Apache Spark. It enables users to write Spark applications using the R programming language, integrating R's statistical capabilities with Spark's distributed processing.
This vulnerability allows an unauthorized local user to impersonate the user running the Spark application. The risks include unauthorized access to sensitive data, privilege escalation, and misuse of the Spark application's resources.
To protect your Spark application, it is recommended to upgrade to Apache Spark version 2.2.2 or later if using PySpark or SparkR. Users on versions 2.1.3 or later are also protected. Additionally, ensure that only trusted local users have access to the Spark application and monitor its activity for any unauthorized access or impersonation attempts.
References
Related vulnerabilities
Recent vulnerabilities recorded for pyspark.
