VulnerableCode Package Details - pkg:maven/org.apache.spark/spark-core@2.3.0

Search for packages

Vulnerability	Summary	Fixed by
VCID-pgne-36yk-37bj Aliases: CVE-2018-8024 GHSA-8cw6-5qvp-q3wj	Information Exposure In Apache Spark it is possible for a malicious user to construct a URL pointing to a Spark cluster UI job and stage info pages, and if a user can be tricked into accessing the URL, can be used to cause script to execute and expose information from the user view of the Spark UI. While some browsers like recent versions of Chrome and Safari are able to block this type of attack, current versions of Firefox (and possibly others) do not.	2.3.1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-vqmm-ru8x-ukcx Aliases: CVE-2019-10099 GHSA-fp5j-3fpf-mhj5 PYSEC-2019-114	Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk (controlled by spark.maxRemoteBlockSizeFetchToMem); in SparkR, using parallelize; in Pyspark, using broadcast and parallelize; and use of python udfs.	2.3.2 Affected by 0 other vulnerabilities.
VCID-y6p4-rd9t-cqad Aliases: CVE-2018-1334 GHSA-6mqq-8r44-vmjc PYSEC-2018-25	In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application.	2.3.1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-pgne-36yk-37bj
Aliases:
CVE-2018-8024
GHSA-8cw6-5qvp-q3wj

Information Exposure In Apache Spark it is possible for a malicious user to construct a URL pointing to a Spark cluster UI job and stage info pages, and if a user can be tricked into accessing the URL, can be used to cause script to execute and expose information from the user view of the Spark UI. While some browsers like recent versions of Chrome and Safari are able to block this type of attack, current versions of Firefox (and possibly others) do not.

2.3.1
Affected by 1 other vulnerability.

VCID-vqmm-ru8x-ukcx
Aliases:
CVE-2019-10099
GHSA-fp5j-3fpf-mhj5
PYSEC-2019-114

Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk (controlled by spark.maxRemoteBlockSizeFetchToMem); in SparkR, using parallelize; in Pyspark, using broadcast and parallelize; and use of python udfs.

2.3.2
Affected by 0 other vulnerabilities.

VCID-y6p4-rd9t-cqad
Aliases:
CVE-2018-1334
GHSA-6mqq-8r44-vmjc
PYSEC-2018-25

In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application.

2.3.1
Affected by 1 other vulnerability.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-02T12:35:59.480653+00:00	GitLab Importer	Affected by	VCID-vqmm-ru8x-ukcx	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.spark/spark-core/CVE-2019-10099.yml	38.0.0
2026-04-01T12:47:50.883591+00:00	GitLab Importer	Affected by	VCID-y6p4-rd9t-cqad	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.spark/spark-core/CVE-2018-1334.yml	38.0.0
2026-04-01T12:47:50.493696+00:00	GitLab Importer	Affected by	VCID-pgne-36yk-37bj	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.spark/spark-core/CVE-2018-8024.yml	38.0.0