CVE-2018-11760 Pyspark User Impersonation Vulnerability
Local users can connect to Spark applications and impersonate the running user, leading to privilege escalation and account takeover.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-11760?
CVE-2018-11760 is a medium-severity authentication bypass vulnerability in Apache Spark, published on 4 Feb 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. This affects versions 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1.
Which versions are affected by CVE-2018-11760?
5 open source packages ship an affected version, including pyspark. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pyspark PyPI | From 1.0.2 | 2.2.3 |
pyspark PyPI | From 1.0.2 | 2.2.3 |
pyspark PyPI | From 2.3.0 | 2.3.2, 2.2.3 |
pyspark PyPI | From 2.3.0 | 2.3.2 |
pyspark PyPI | From 2.3.0 | 2.3.2 |
Products include Apache Spark.
How do I fix CVE-2018-11760?
Upgrade pyspark to a fixed version for your release line: 2.2.3 or 2.3.2.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2018-11760 being exploited?
There is no known exploitation of CVE-2018-11760 in the wild and no public exploit code.
Other vulnerabilities in Apache Spark
Sources
Also known as GHSA-fvxv-9xxr-h7wj, PYSEC-2019-169.