CVE-2018-11760: Impersonation Vulnerability in PySpark
Summary
CVE-2018-11760: When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. Affects pyspark across 2 version ranges.
>= 1.0.2, < 2.2.3
>= 2.3.0, < 2.3.2
Fixed in 2.2.3 or 2.3.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PySpark is a Python library for Apache Spark, a fast and general-purpose cluster computing system. It provides a Python API for interacting with Spark and enables distributed processing of large datasets. PySpark is widely used in big data analytics and machine learning applications. However, versions 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1 of PySpark are vulnerable to an impersonation attack.
Vulnerability Detail
The vulnerability allows a different local user to connect to a Spark application and impersonate the user running the application. This can lead to unauthorized access and potential misuse of sensitive data. The issue affects multiple versions of PySpark and can be exploited by an attacker with local access to the system running the Spark application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.0.2, < 2.2.32.2.3pip install --upgrade "pyspark==2.2.3" -
>= 2.3.0, < 2.3.22.3.2pip install --upgrade "pyspark==2.3.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to follow the recommended fix and upgrade to the fixed versions of PySpark.
Conclusion
The impersonation vulnerability in PySpark can allow unauthorized access and misuse of sensitive data. It is crucial to upgrade to the fixed versions of PySpark to mitigate this risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pyspark →
FAQ
PySpark is a Python library for Apache Spark, a distributed computing system used for big data processing and analytics.
The vulnerability allows a local user to impersonate the user running a Spark application, potentially leading to unauthorized access and misuse of sensitive data.
Versions 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1 of PySpark are affected by this vulnerability.
To fix the vulnerability, upgrade to the recommended fixed versions of PySpark: 2.3.2 for versions 2.3.0 to 2.3.1, and 2.2.3 for versions 1.x and 2.2.0 to 2.2.2.
No specific workaround is mentioned for this vulnerability. It is advised to upgrade to the fixed versions of PySpark.
Related vulnerabilities
Recent vulnerabilities recorded for pyspark.
