Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/apache-airflow-providers-apache-spark@2.0.2
Typepypi
Namespace
Nameapache-airflow-providers-apache-spark
Version2.0.2
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version4.1.3
Latest_non_vulnerable_version4.1.3
Affected_by_vulnerabilities
0
url VCID-k6g3-jfa6-ukhy
vulnerability_id VCID-k6g3-jfa6-ukhy
summary 
Deserialization of Untrusted Data, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Software Foundation Apache Airflow Spark Provider.

When the Apache Spark provider is installed on an Airflow deployment, an Airflow user that is authorized to configure Spark hooks can effectively run arbitrary code on the Airflow node by pointing it at a malicious Spark server. Prior to version 4.1.3, this was not called out in the documentation explicitly, so it is possible that administrators provided authorizations to configure Spark hooks without taking this into account. We recommend administrators to review their configurations to make sure the authorization to configure Spark hooks is only provided to fully trusted users.

To view the warning in the docs please visit  https://airflow.apache.org/docs/apache-airflow-providers-apache-spark/4.1.3/connections/spark.html
references
0
reference_url https://github.com/apache/airflow/commit/6850b5c777fa515e110ad1daa85242209a8ec6c0
reference_id
reference_type
scores
url https://github.com/apache/airflow/commit/6850b5c777fa515e110ad1daa85242209a8ec6c0
1
reference_url https://github.com/apache/airflow/pull/33233
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
url https://github.com/apache/airflow/pull/33233
2
reference_url https://lists.apache.org/thread/fzy95b1d6zv31j5wrx3znhzcscck2o24
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
url https://lists.apache.org/thread/fzy95b1d6zv31j5wrx3znhzcscck2o24
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-40195
reference_id CVE-2023-40195
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2023-40195
4
reference_url https://github.com/advisories/GHSA-8q28-pw9g-w82c
reference_id GHSA-8q28-pw9g-w82c
reference_type
scores
url https://github.com/advisories/GHSA-8q28-pw9g-w82c
fixed_packages
0
url pkg:pypi/apache-airflow-providers-apache-spark@4.1.3
purl pkg:pypi/apache-airflow-providers-apache-spark@4.1.3
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-airflow-providers-apache-spark@4.1.3
aliases CVE-2023-40195, GHSA-8q28-pw9g-w82c, PYSEC-2023-156
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-k6g3-jfa6-ukhy
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/apache-airflow-providers-apache-spark@2.0.2