CVE-2019-10099 Sensitive data written to disk unencrypted in Spark

What is CVE-2019-10099?

CVE-2019-10099 is a high-severity vulnerability in Apache Spark, published on 7 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk (controlled by spark.maxRemoteBlockSizeFetchToMem); in SparkR, using parallelize; in Pyspark, using broadcast and parallelize; and use of python udfs.

Weakness: CWE-312

Which versions are affected by CVE-2019-10099?

5 open source packages ship an affected version, including org.apache.spark:spark-core_2.11 and pyspark. It affects 1 product.

Products include Apache Spark.

How do I fix CVE-2019-10099?

Upgrade org.apache.spark:spark-core_2.11 to 2.3.3 or later.

Is CVE-2019-10099 being exploited?

There is no known exploitation of CVE-2019-10099 in the wild and no public exploit code.

Other vulnerabilities in Apache Spark

• CVE-2022-33891 Apache Spark Command Injection Exploited High 8.8
• CVE-2020-9480 Improper Authentication in Apache Spark Critical 9.8
• CVE-2018-17190 Remote Code Execution in spark-core Critical 9.8
• CVE-2019-20445 HTTP Request Smuggling in Netty Critical 9.1
• CVE-2025-54920 Apache Spark: Spark History Server Code Execution Vulnerability High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fp5j-3fpf-mhj5, PYSEC-2019-114.