[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 28 Jan 2019 14:23:07 -0600
From: Imran Rashid <irashid@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2018-11760: Apache Spark local privilege escalation vulnerability
Severity: Important
Vendor: The Apache Software Foundation
Versions affected:
All Spark 1.x, Spark 2.0.x, and Spark 2.1.x versions
Spark 2.2.0 to 2.2.2
Spark 2.3.0 to 2.3.1
Description:
When using PySpark , it's possible for a different local user to connect to
the Spark application and impersonate the user running the Spark
application. This affects versions 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and
2.3.0 to 2.3.1.
Mitigation:
1.x, 2.0.x, 2.1.x, and 2.2.x users should upgrade to 2.2.3 or newer
2.3.x users should upgrade to 2.3.2 or newer
Otherwise, affected users should avoid using PySpark in multi-user
environments.
Credit:
This issue was reported by Luca Canali and Jose Carlos Luna Duran from CERN.
References:
https://spark.apache.org/security.html
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
