Vulnerability in Apache Spark
CVE-2019-10099
Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk (controlled by spark.maxRemoteBlockSizeFetchT…
EPSS: 0.003 (52.2th percentile) — read the EPSS interpretation.
Affected products
- Apache Spark — versions 2.3.2 and below
Public proof-of-concept exploits
References
- lists.apache.org/thread.html/c2a39c207421797f82823a8aff488dcd332d9544038307bf69… (x_refsource_MISC)
- [spark-issues] 20200318 [jira] [Commented] (SPARK-28626) Spark leaves unencrypted data on local disk, even with encryption turned on (CVE-2019-10099) (mailing-list, x_refsource_MLIST)
- [spark-commits] 20200622 [spark-website] branch asf-site updated: CVE-2020-9480 details (#275) (mailing-list, x_refsource_MLIST)
Frequently asked questions
- What is CVE-2019-10099?
- CVE-2019-10099 is a vulnerability in Apache Spark. Published 2019-08-07.
- Is CVE-2019-10099 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.