VulnerableCode Package Details - pkg:maven/org.apache.spark/spark-core@2.3.0

Search for packages

Vulnerability	Summary	Fixed by
VCID-2md5-chbw-aaaj Aliases: CVE-2018-1334 GHSA-6mqq-8r44-vmjc PYSEC-2018-25	In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application.	2.3.1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-6e2g-d1n5-aaam Aliases: CVE-2019-10099 GHSA-fp5j-3fpf-mhj5 PYSEC-2019-114 PYSEC-2019-44	Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk (controlled by spark.maxRemoteBlockSizeFetchToMem); in SparkR, using parallelize; in Pyspark, using broadcast and parallelize; and use of python udfs.	2.3.2 Affected by 0 other vulnerabilities.
VCID-xr14-da7p-aaam Aliases: CVE-2018-8024 GHSA-8cw6-5qvp-q3wj	Low severity vulnerability that affects org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11	2.3.1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-2md5-chbw-aaaj
Aliases:
CVE-2018-1334
GHSA-6mqq-8r44-vmjc
PYSEC-2018-25

In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application.

2.3.1
Affected by 1 other vulnerability.

VCID-6e2g-d1n5-aaam
Aliases:
CVE-2019-10099
GHSA-fp5j-3fpf-mhj5
PYSEC-2019-114
PYSEC-2019-44

Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk (controlled by spark.maxRemoteBlockSizeFetchToMem); in SparkR, using parallelize; in Pyspark, using broadcast and parallelize; and use of python udfs.

2.3.2
Affected by 0 other vulnerabilities.

VCID-xr14-da7p-aaam
Aliases:
CVE-2018-8024
GHSA-8cw6-5qvp-q3wj

Low severity vulnerability that affects org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11

2.3.1
Affected by 1 other vulnerability.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2024-09-17T22:37:27.368979+00:00	GitLab Importer	Affected by	VCID-6e2g-d1n5-aaam	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.spark/spark-core/CVE-2019-10099.yml	34.0.1
2024-09-17T22:37:27.220469+00:00	GitLab Importer	Affected by	VCID-2md5-chbw-aaaj	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.spark/spark-core/CVE-2018-1334.yml	34.0.1
2024-09-17T22:37:27.142408+00:00	GitLab Importer	Affected by	VCID-xr14-da7p-aaam	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.spark/spark-core/CVE-2018-8024.yml	34.0.1
2024-01-03T18:00:22.146136+00:00	GitLab Importer	Affected by	VCID-6e2g-d1n5-aaam	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.spark/spark-core/CVE-2019-10099.yml	34.0.0rc1
2024-01-03T18:00:22.011348+00:00	GitLab Importer	Affected by	VCID-2md5-chbw-aaaj	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.spark/spark-core/CVE-2018-1334.yml	34.0.0rc1
2024-01-03T18:00:21.946476+00:00	GitLab Importer	Affected by	VCID-xr14-da7p-aaam	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.spark/spark-core/CVE-2018-8024.yml	34.0.0rc1