Search for packages
| purl | pkg:pypi/pyspark@0 |
| Tags | Ghost |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-hfnr-s2a7-bkbv
Aliases: BIT-spark-2022-33891 CVE-2022-33891 GHSA-4x9r-j582-cgr8 PYSEC-2022-236 |
The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1. |
Affected by 6 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 1 other vulnerability. |
|
VCID-vqmm-ru8x-ukcx
Aliases: CVE-2019-10099 GHSA-fp5j-3fpf-mhj5 PYSEC-2019-114 |
Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk (controlled by spark.maxRemoteBlockSizeFetchToMem); in SparkR, using parallelize; in Pyspark, using broadcast and parallelize; and use of python udfs. |
Affected by 6 other vulnerabilities. |
|
VCID-y6p4-rd9t-cqad
Aliases: CVE-2018-1334 GHSA-6mqq-8r44-vmjc PYSEC-2018-25 |
In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. |
Affected by 9 other vulnerabilities. Affected by 9 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-04-01T16:02:50.133997+00:00 | GHSA Importer | Affected by | VCID-hfnr-s2a7-bkbv | https://github.com/advisories/GHSA-4x9r-j582-cgr8 | 38.0.0 |
| 2026-04-01T15:57:38.226523+00:00 | GHSA Importer | Affected by | VCID-vqmm-ru8x-ukcx | https://github.com/advisories/GHSA-fp5j-3fpf-mhj5 | 38.0.0 |
| 2026-04-01T15:57:23.171141+00:00 | GHSA Importer | Affected by | VCID-y6p4-rd9t-cqad | https://github.com/advisories/GHSA-6mqq-8r44-vmjc | 38.0.0 |