CVE-2021-38296: Apache Spark - Encryption Key Recovery
Summary
CVE-2021-38296: Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". Affects pyspark versions < 3.1.3. Fixed in 3.1.3. How to fix ↓
Also tracked for
- spark · Bitnami
- org.apache.spark:spark-core · Maven
- org.apache.spark:spark-core · Maven
The same CVE-2021-38296 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Spark is a fast and general-purpose cluster computing system that provides distributed data processing capabilities. It supports end-to-end encryption of RPC connections to ensure secure communication. However, versions 3.1.2 and earlier of Apache Spark utilize a custom mutual authentication protocol that allows for full encryption key recovery. This vulnerability could be exploited through an initial interactive attack, enabling an attacker to decrypt plaintext traffic offline. It is important to note that this vulnerability does not impact security mechanisms controlled by other configuration options such as 'spark.authenticate.enableSaslEncryption', 'spark.io.encryption.enabled', 'spark.ssl', and 'spark.ui.strictTransportSecurity'.
Vulnerability Detail
The vulnerability in Apache Spark versions 3.1.2 and earlier lies in the bespoke mutual authentication protocol used for end-to-end encryption of RPC connections. This protocol allows for full encryption key recovery, which means that an attacker who successfully performs an initial interactive attack can decrypt plaintext traffic offline. This poses a significant risk to the confidentiality of sensitive data transmitted over RPC connections. It is crucial for users of affected versions to update to Apache Spark 3.1.3 or later to mitigate this vulnerability.
How To Fix
Minimum fixed version
3.1.3
This is the first release that contains the fix.
pip install --upgrade "pyspark==3.1.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in Apache Spark versions 3.1.2 and earlier allows for encryption key recovery, enabling an attacker to decrypt plaintext traffic offline. To mitigate this vulnerability, users should update to Apache Spark 3.1.3 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pyspark →
FAQ
Apache Spark is a fast and general-purpose cluster computing system that provides distributed data processing capabilities. It is widely used for big data processing and analytics tasks.
This vulnerability allows an attacker to recover encryption keys used for securing RPC connections in Apache Spark. With the recovered keys, the attacker can decrypt plaintext traffic offline, potentially exposing sensitive data transmitted over RPC connections.
Versions 3.1.2 and earlier of Apache Spark are affected by this vulnerability.
No, there are no known workarounds for this vulnerability. Users are advised to update to Apache Spark 3.1.3 or later to fix the issue.
You can find more information about this vulnerability in the Apache Spark advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/pyspark/PYSEC-2022-186.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for pyspark.
