CVE-2017-12612 Apache Spark Deserialization of Untrusted Data vulnerability

What is CVE-2017-12612?

CVE-2017-12612 is a high-severity unsafe deserialization vulnerability in n/a, published on 13 Sep 2017. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched programmatically using the launcher API potentially vulnerable to arbitrary code execution by an attacker with access to any user account on the local machine. It does not affect apps run by spark-submit or spark-shell. The attacker would be able to execute code as the user that ran the Spark application. Users are encouraged to update to version 2.2.0 or later.

Weakness: CWE-502

Which versions are affected by CVE-2017-12612?

7 open source packages ship an affected version, including pyspark, org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11. It affects 1 product.

Products include Apache Spark.

How do I fix CVE-2017-12612?

Upgrade pyspark to 2.1.2 or later.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2017-12612 being exploited?

There is no known exploitation of CVE-2017-12612 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2022-33891 Apache Spark Command Injection Exploited High 8.8
• CVE-2020-9480 Improper Authentication in Apache Spark Critical 9.8
• CVE-2018-17190 Remote Code Execution in spark-core Critical 9.8
• CVE-2019-20445 HTTP Request Smuggling in Netty Critical 9.1
• CVE-2025-54920 Apache Spark: Spark History Server Code Execution Vulnerability High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8rhc-48pp-52gr, PYSEC-2017-147.