Vulnerability in Apache Spark
CVE-2018-17190
In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'worker' hosts. The master itself does not, by design, execute user code. A specially-crafted request to the master can, however, cause the master to execute code too. Note that this does not affect standalone clusters with authentication enabled. While the master host typically has less outbound access to other resources than a worker, the execution of code on the master is nevertheless unexpected.
EPSS: 0.088 (94.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apache Spark
- Apache Software Foundation Spark — versions All versions
Public proof-of-concept exploits
References
- security@apache.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- security@apache.org (vendor-advisory, Third Party Advisory, x_refsource_GENTOO)
- security@apache.org (x_refsource_MISC)
- security@apache.org (x_refsource_MISC)
Frequently asked questions
- What is CVE-2018-17190?
- CVE-2018-17190 is a critical-severity vulnerability in Apache Spark. CVSS score: 9.8/10. Published 2018-11-19.
- How severe is CVE-2018-17190?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2018-17190 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.