GitStock

apache/spark · Security

Pyspark User Impersonation Vulnerability

GHSA ID
GHSA-fvxv-9xxr-h7wj
CVE ID
CVE-2018-11760
Severity
medium
Published
Updated
CVSS
5.5 · CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v3
5.5 · CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4
6.8 · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Description

When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. This affects versions 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1.

References